CVE-2013-0237 WordPress Core < 3.5.1 - Cross-Site Scripting
MediumCVSS 4.3
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/wordpress(Debian:12) | < 3.5.1+dfsg-1 | 3.5.1+dfsg-1 |
| debian/wordpress(Debian:13) | < 3.5.1+dfsg-1 | 3.5.1+dfsg-1 |
| debian/wordpress(Debian:14) | < 3.5.1+dfsg-1 | 3.5.1+dfsg-1 |
| moxiecode plupload | <= 1.5.4 | No fix listed |
| moxiecode plupload | = 1.4.0 | No fix listed |
| moxiecode plupload | = 1.4.1 | No fix listed |
| moxiecode plupload | = 1.4.2 | No fix listed |
| moxiecode plupload | = 1.4.3 | No fix listed |
| moxiecode plupload | = 1.5.0 | No fix listed |
| moxiecode plupload | = 1.5.0-beta | No fix listed |
| moxiecode plupload | = 1.5.1 | No fix listed |
| moxiecode plupload | = 1.5.2 | No fix listed |
| moxiecode plupload | = 1.5.3 | No fix listed |
| WordPress | <= 3.5.0 | No fix listed |
| WordPress | = 0.71 | No fix listed |
| WordPress | = 1.0 | No fix listed |
| WordPress | = 1.0.1 | No fix listed |
| WordPress | = 1.0.2 | No fix listed |
| WordPress | = 1.1.1 | No fix listed |
| WordPress | = 1.2 | No fix listed |
| WordPress | = 1.2.1 | No fix listed |
| WordPress | = 1.2.2 | No fix listed |
| WordPress | = 1.2.3 | No fix listed |
| WordPress | = 1.2.4 | No fix listed |
| WordPress | = 1.2.5 | No fix listed |
Show 68 more
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress | = 1.2.5-a | No fix listed |
| WordPress | = 1.3 | No fix listed |
| WordPress | = 1.3.2 | No fix listed |
| WordPress | = 1.3.3 | No fix listed |
| WordPress | = 1.5 | No fix listed |
| WordPress | = 1.5.1 | No fix listed |
| WordPress | = 1.5.1.1 | No fix listed |
| WordPress | = 1.5.1.2 | No fix listed |
| WordPress | = 1.5.1.3 | No fix listed |
| WordPress | = 1.5.2 | No fix listed |
| WordPress | = 1.6.2 | No fix listed |
| WordPress | = 2.0 | No fix listed |
| WordPress | = 2.0.1 | No fix listed |
| WordPress | = 2.0.2 | No fix listed |
| WordPress | = 2.0.4 | No fix listed |
| WordPress | = 2.0.5 | No fix listed |
| WordPress | = 2.0.6 | No fix listed |
| WordPress | = 2.0.7 | No fix listed |
| WordPress | = 2.0.8 | No fix listed |
| WordPress | = 2.0.9 | No fix listed |
| WordPress | = 2.0.10 | No fix listed |
| WordPress | = 2.0.11 | No fix listed |
| WordPress | = 2.1 | No fix listed |
| WordPress | = 2.1.1 | No fix listed |
| WordPress | = 2.1.2 | No fix listed |
| WordPress | = 2.1.3 | No fix listed |
| WordPress | = 2.2 | No fix listed |
| WordPress | = 2.2.1 | No fix listed |
| WordPress | = 2.2.2 | No fix listed |
| WordPress | = 2.2.3 | No fix listed |
| WordPress | = 2.3 | No fix listed |
| WordPress | = 2.3.1 | No fix listed |
| WordPress | = 2.3.2 | No fix listed |
| WordPress | = 2.3.3 | No fix listed |
| WordPress | = 2.5 | No fix listed |
| WordPress | = 2.5.1 | No fix listed |
| WordPress | = 2.6 | No fix listed |
| WordPress | = 2.6.1 | No fix listed |
| WordPress | = 2.6.2 | No fix listed |
| WordPress | = 2.6.3 | No fix listed |
| WordPress | = 2.6.5 | No fix listed |
| WordPress | = 2.7 | No fix listed |
| WordPress | = 2.7.1 | No fix listed |
| WordPress | = 2.8 | No fix listed |
| WordPress | = 2.8.1 | No fix listed |
| WordPress | = 2.8.2 | No fix listed |
| WordPress | = 2.8.3 | No fix listed |
| WordPress | = 2.8.4 | No fix listed |
| WordPress | = 2.8.4-a | No fix listed |
| WordPress | = 2.8.5 | No fix listed |
| WordPress | = 2.8.5.1 | No fix listed |
| WordPress | = 2.8.5.2 | No fix listed |
| WordPress | = 2.8.6 | No fix listed |
| WordPress | = 2.9 | No fix listed |
| WordPress | = 2.9.1 | No fix listed |
| WordPress | = 2.9.1.1 | No fix listed |
| WordPress | = 2.9.2 | No fix listed |
| WordPress | = 3.3 | No fix listed |
| WordPress | = 3.3.1 | No fix listed |
| WordPress | = 3.3.2 | No fix listed |
| WordPress | = 3.3.3 | No fix listed |
| WordPress | = 3.4.0 | No fix listed |
| WordPress | = 3.4.1 | No fix listed |
| WordPress | = 3.4.2 | No fix listed |
| fedoraproject fedora | = 16 | No fix listed |
| fedoraproject fedora | = 17 | No fix listed |
| fedoraproject fedora | = 18 | No fix listed |
| WordPress(WordPress) | < 3.5.1 | 3.5.1 |
References
- Debian Security Tracker CVE-2013-0237 vendor-advisory
- codex.wordpress.org
- wordpress.org vendor-advisory
- bugzilla.redhat.com
- github.com exploit patch
- Wordfence Intelligence third-party-advisory
- www.cve.org
- bugs.debian.org issue-tracking