CVEvulnerability
CVE-2015-3439
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-08-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.
Affected configurations
• debian debian linux 7.0
• debian debian linux 8.0
• wordpress wordpress 3.9.0
• wordpress wordpress 3.9.1
• wordpress wordpress 3.9.2
• wordpress wordpress 3.9.3
• wordpress wordpress 4.0
• wordpress wordpress 4.0.1
• wordpress wordpress 4.1
• wordpress wordpress 4.1.1
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://codex.wordpress.org/Version_4.1.2 Exploit, Patch
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html lists.fedoraproject.org
- http://www.debian.org/security/2015/dsa-3250 www.debian.org
- http://www.securityfocus.com/bid/74269 www.securityfocus.com
- http://www.securitytracker.com/id/1032207 www.securitytracker.com
- http://zoczus.blogspot.com/2015/04/plupload-same-origin-method-execution.html Exploit
- https://core.trac.wordpress.org/changeset/32168 core.trac.wordpress.org
- https://wordpress.org/news/2015/04/wordpress-4-1-2/ Exploit, Vendor Advisory
- https://wpvulndb.com/vulnerabilities/7933 wpvulndb.com
- http://codex.wordpress.org/Version_4.1.2 Exploit, Patch
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html lists.fedoraproject.org
- http://www.debian.org/security/2015/dsa-3250 www.debian.org
- http://www.securityfocus.com/bid/74269 www.securityfocus.com
- http://www.securitytracker.com/id/1032207 www.securitytracker.com
- http://zoczus.blogspot.com/2015/04/plupload-same-origin-method-execution.html Exploit
- https://core.trac.wordpress.org/changeset/32168 core.trac.wordpress.org
- https://wordpress.org/news/2015/04/wordpress-4-1-2/ Exploit, Vendor Advisory
- https://wpvulndb.com/vulnerabilities/7933 wpvulndb.com