CVE-2014-4603 Yahoo Updates For WordPress <= 1.0 - Cross-Site Scripting
MediumCVSS 4.3
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in yupdates_application.php in the Yahoo! Updates for WordPress plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) secret, (2) key, or (3) appid parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yahoo updates for wordpress plugin project yahoo updates for wordpress plugin | <= 1.0 | No fix listed |
| wordpress yahoo-updates-for-wordpress(WordPress) | <= 1.0 | No fix listed |
References
- codevigilant.com exploit
- 68401 exploit vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org