4.3

CVE-2015-3439

Exploit

WordPress Core < 4.1.2 - Cross-Site Scripting via Ephox in Plupload

Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.
Mögliche Gegenmaßnahme
WordPress: Update to one of the following versions, or a newer patched version: 3.7.6, 3.8.6, 3.9.4, 4.0.2, 4.1.2
Weitere Schwachstelleninformationen
SystemWordPress Core
≫
Produkt WordPress
Version [*, 3.7)
Version 3.7 - 3.7.5
Version 3.8 - 3.8.5
Version 3.9 - 3.9.3
Version 4.0 - 4.0.1
Version 4.1 - 4.1.1
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version8.0
Wordpress ≫ Wordpress Version3.9.0
Wordpress ≫ Wordpress Version3.9.1
Wordpress ≫ Wordpress Version3.9.2
Wordpress ≫ Wordpress Version3.9.3
Wordpress ≫ Wordpress Version4.0
Wordpress ≫ Wordpress Version4.0.1
Wordpress ≫ Wordpress Version4.1
Wordpress ≫ Wordpress Version4.1.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.58% 0.85
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.