CVE-2016-4566

MEDIUM · 6.1 CVSS Gepubliceerd: 22-05-2016 CWE-79

Beschrijving

Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.

Vendors

Wordpress Plupload

Affected products

Wordpress Plupload

References

www.openwall.com
www.plupload.com
www.securitytracker.com
codex.wordpress.org
core.trac.wordpress.org
gist.github.com
wordpress.org
wpvulndb.com