Description

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.

Remediation

References

CVE-2012-2399

Related Vulnerabilities

WordPress Plugin SCORM Cloud For WordPress 'ajax.php' SQL Injection (1.0.6.6)

WordPress Plugin Portfolio Gallery-Photo Gallery Multiple Unspecified Vulnerabilities (2.0.72)

Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-20102)

MongoDb Incorrect Comparison Vulnerability (CVE-2019-20925)

WordPress Plugin Responsive Lightbox by dFactory Cross-Site Scripting (1.4.11)

Severity

Critical

Classification

CVE-2012-2399

Tags

Missing Update Known Vulnerabilities