Plupload cross-site scripting vulnerability

Description
  • Plupload allows you to upload files using HTML5 Gears, Silverlight, Flash, BrowserPlus or normal forms, providing some unique features such as upload progress, image resizing and chunked uploads. This version of Plupload is vulnerable to cross-site scripting. The affected file is <span class="bb-dark"><strong>plupload.flash.swf</strong></span>. <br/><br/> The vulnerable file is included in WordPress versions 3.5, 3.4.2, 3.4.1, 3.4, 3.3.3 and 3.3.2.<br/><br/> Proof of Concept: <pre> wp-includes/js/plupload/plupload.flash.swf?id=\"));}catch(e){alert(1);}// </pre>
Remediation
  • Upgrade to the latest version of Plupload.
References