Description

wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data.

Remediation

References

CVE-2014-5203

Related Vulnerabilities

EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14329)

WordPress Plugin WP Limit Login Attempts SQL Injection (2.0.0)

WordPress Plugin WP Background Takeover Directory Traversal (4.1.4)

Oracle Application Server CVE-2007-5523 Vulnerability (CVE-2007-5523)

Python Credentials Management Errors Vulnerability (CVE-2019-10160)

Severity

High

Classification

CVE-2014-5203

Tags

Missing Update Known Vulnerabilities