CVE-2016-4566 WordPress Core < 4.5.2 - Cross-Site Scripting via plupload.flash.swf
MediumCVSS 6.1
EPSS 6.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/wordpress(Debian:12) | < 4.5.2+dfsg-1 | 4.5.2+dfsg-1 |
| debian/wordpress(Debian:13) | < 4.5.2+dfsg-1 | 4.5.2+dfsg-1 |
| debian/wordpress(Debian:14) | < 4.5.2+dfsg-1 | 4.5.2+dfsg-1 |
| WordPress | <= 4.5.1 | No fix listed |
| plupload | <= 2.1.8 | No fix listed |
| WordPress(WordPress) | < 3.7 | 3.7 |
| WordPress(WordPress) | >= 3.7, < 3.7.14 | 3.7.14 |
| WordPress(WordPress) | >= 3.8, < 3.8.14 | 3.8.14 |
| WordPress(WordPress) | >= 3.9, < 3.9.12 | 3.9.12 |
| WordPress(WordPress) | >= 4.0, < 4.0.11 | 4.0.11 |
| WordPress(WordPress) | >= 4.1, < 4.1.11 | 4.1.11 |
| WordPress(WordPress) | >= 4.2, < 4.2.8 | 4.2.8 |
| WordPress(WordPress) | >= 4.3, < 4.3.4 | 4.3.4 |
| WordPress(WordPress) | >= 4.4, < 4.4.3 | 4.4.3 |
| WordPress(WordPress) | >= 4.5, < 4.5.2 | 4.5.2 |
References
- Debian Security Tracker CVE-2016-4566 vendor-advisory
- [oss-security] 20160507 CVE Request: wordpress and mediaelement mailing-list
- www.plupload.com vendor-advisory
- 1035818 third-party-advisory vdb-entry
- codex.wordpress.org patch
- core.trac.wordpress.org patch
- gist.github.com third-party-advisory
- wordpress.org patch vendor-advisory
- wpvulndb.com third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org
- bugs.debian.org issue-tracking