4.3
CVE-2013-0237
- EPSS 3.14%
- Veröffentlicht 08.07.2013 20:55:00
- Zuletzt bearbeitet 29.04.2026 01:13:23
- Erkennungen
LoginWordPress Core < 3.5.1 - Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Mögliche Gegenmaßnahme
WordPress: Update to version 3.5.1, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fedoraproject ≫ Fedora Version 16
Fedoraproject ≫ Fedora Version 17
Fedoraproject ≫ Fedora Version 18
Weitere Schwachstelleninformationen
SystemWordPress Core
≫
Produkt
WordPress
Version
*-3.5
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 3.14% | 0.862 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
http://codex.wordpress.org/Version_3.5.1
http://wordpress.org/news/2013/01/wordpress-3-5-1/
https://bugzilla.redhat.com/show_bug.cgi?id=904122
https://github.com/moxiecode/plupload/commit/2d746ee9083c184f1234d8fed311e89bdd1b39e5
https://www.wordfence.com/threat-intel/vulnerabilities/id/dbcdeda4-85b7-48d6-b89d-1d1756d183d2