WordPress CVEs

Description

Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.

Affected WordPress components

• WordPress core
  Confirmed match
  Up to and including 4.5.1

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Up to and including 4.5.1

References

• www.openwall.com http://www.openwall.com/lists/oss-security/2016/05/07/2
• www.plupload.com http://www.plupload.com/punbb/viewtopic.php?pid=28690 Vendor Advisory
• www.securitytracker.com http://www.securitytracker.com/id/1035818 Third Party Advisory, VDB Entry
• codex.wordpress.org https://codex.wordpress.org/Version_4.5.2 Patch
• core.trac.wordpress.org https://core.trac.wordpress.org/changeset/37382/ Patch
• gist.github.com https://gist.github.com/cure53/09a81530a44f6b8173f545accc9ed07e Third Party Advisory
• wordpress.org https://wordpress.org/news/2016/05/wordpress-4-5-2/ Patch, Vendor Advisory
• wpvulndb.com https://wpvulndb.com/vulnerabilities/8489 Third Party Advisory
• nvd.nist.gov Official NVD record