CVE-2016-6634

MEDIUM 6.1 CVSS 3.0

Published: August 7, 2016
Last modified: June 17, 2026
NVD status: Modified
Reported by: cve@mitre.org
Weakness: CWE-79
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected WordPress components

WordPress core

Confirmed match

Up to and including 4.4.4

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

n/a n/a — Versions not specified
wordpress wordpress — Up to and including 4.4.4

References

codex.wordpress.org http://codex.wordpress.org/Version_4.5 Patch, Release Notes
www.debian.org http://www.debian.org/security/2016/dsa-3681
www.securityfocus.com http://www.securityfocus.com/bid/92390 Third Party Advisory, VDB Entry
core.trac.wordpress.org https://core.trac.wordpress.org/query?status=closed&milestone=4.5 Release Notes
wpvulndb.com https://wpvulndb.com/vulnerabilities/8474 Third Party Advisory, VDB Entry
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected WordPress components

Affected products and versions

References