CVE-2014-4664 Wordfence Security – Firewall & Malware Scan <= 5.1.3 - Cross-Site Scripting
MediumCVSS 4.3
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to wp-admin/admin.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordfence security project wordfence security | = 5.0.1 | No fix listed |
| wordfence security project wordfence security | = 5.0.2 | No fix listed |
| wordfence security project wordfence security | = 5.0.3 | No fix listed |
| wordfence security project wordfence security | = 5.0.4 | No fix listed |
| wordfence security project wordfence security | = 5.0.5 | No fix listed |
| wordfence security project wordfence security | = 5.0.6 | No fix listed |
| wordfence security project wordfence security | = 5.0.7 | No fix listed |
| wordfence security project wordfence security | = 5.0.8 | No fix listed |
| wordfence security project wordfence security | = 5.0.9 | No fix listed |
| wordfence security project wordfence security | = 5.1.1 | No fix listed |
| wordfence security project wordfence security | = 5.1.2 | No fix listed |
| wordpress wordfence(WordPress) | < 5.1.4 | 5.1.4 |
References
- hacktivity.websecgeeks.com
- 20141105 WordPress Wordfence Firewall 5.1.2 Cross Site Scripting mailing-list
- 70911 vdb-entry
- 70915 exploit vdb-entry
- www.wordfence.com vendor-advisory
- wordpress.org patch vendor-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org