blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2014-5196

MEDIUM 4.3 CVSS 2.0
Published
August 12, 2014
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-79
CVSS vector
AV:N/AC:M/Au:N/C:N/I:P/A:N

Description

Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the iusib_meta_fields parameter.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • n/a n/a — Versions not specified
  • improved_user_search_in_backend_project improved_user_search_in_backend — Up to and including 1.2.4

References

  • secunia.com http://secunia.com/advisories/60590
  • wordpress.org http://wordpress.org/plugins/improved-user-search-in-backend/changelog Patch, Vendor Advisory
  • security.dxw.com https://security.dxw.com/advisories/csrf-and-xss-in-improved-user-search-allow-execution-of-arbitrary-javascript-in-wordpress-admin-area/ Exploit
  • nvd.nist.gov Official NVD record