CVE-2014-9032
MEDIUM
4.3
CVSS 2.0
Description
Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected WordPress components
-
WordPress coreVersion 3.9; Version 3.9.1; Version 3.9.2; Version 4.0
A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.
Affected products and versions
- n/a n/a — Versions not specified
- wordpress wordpress — Version 3.9
- wordpress wordpress — Version 3.9.1
- wordpress wordpress — Version 3.9.2
- wordpress wordpress — Version 4.0
References
- advisories.mageia.org http://advisories.mageia.org/MGASA-2014-0493.html
- openwall.com http://openwall.com/lists/oss-security/2014/11/25/12
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2014:233
- www.securityfocus.com http://www.securityfocus.com/bid/71236
- www.securitytracker.com http://www.securitytracker.com/id/1031243
- wordpress.org https://wordpress.org/news/2014/11/wordpress-4-0-1/ Patch, Vendor Advisory
- nvd.nist.gov Official NVD record