Skip to content

Product

moxiecode plupload vulnerabilities

2 published CVES affecting moxiecode plupload, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest moxiecode plupload CVEs

Newest publication first

  1. CVE-2013-0237 WordPress Core < 3.5.1 - Cross-Site Scripting

    Published
    MediumCVSS 4.3 EPSS 3.1%

    Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.

  2. CVE-2012-2401 WordPress Core <= 3.3.1 - Same Origin Policy Bypass

    Published
    MediumCVSS 5.0 EPSS 3.5%

    Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.