CVE-2014-9031
MEDIUM
4.3
CVSS 2.0
Description
Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field, as demonstrated by a comment or a post.
Affected WordPress components
-
WordPress coreUp to and including 3.7.4; Version 3.8; Version 3.8.1; Version 3.8.2; Version 3.8.3; Version 3.8.4; Version 3.9; Version 3.9.1; Version 3.9.2
A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.
Affected products and versions
- n/a n/a — Versions not specified
- wordpress wordpress — Up to and including 3.7.4
- wordpress wordpress — Version 3.8
- wordpress wordpress — Version 3.8.1
- wordpress wordpress — Version 3.8.2
- wordpress wordpress — Version 3.8.3
- wordpress wordpress — Version 3.8.4
- wordpress wordpress — Version 3.9
- wordpress wordpress — Version 3.9.1
- wordpress wordpress — Version 3.9.2
References
- advisories.mageia.org http://advisories.mageia.org/MGASA-2014-0493.html
- klikki.fi http://klikki.fi/adv/wordpress.html
- openwall.com http://openwall.com/lists/oss-security/2014/11/25/12
- seclists.org http://seclists.org/fulldisclosure/2014/Nov/62
- www.debian.org http://www.debian.org/security/2014/dsa-3085
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2014:233
- www.securityfocus.com http://www.securityfocus.com/bid/71237
- www.securitytracker.com http://www.securitytracker.com/id/1031243
- wordpress.org https://wordpress.org/news/2014/11/wordpress-4-0-1/ Patch, Vendor Advisory
- nvd.nist.gov Official NVD record