Description
WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.
Remediation
References
Related Vulnerabilities
MySQL CVE-2014-0427 Vulnerability (CVE-2014-0427)
OpenSSL Out-of-bounds Read Vulnerability (CVE-2014-0160)
MySQL CVE-2012-3149 Vulnerability (CVE-2012-3149)
WordPress Plugin WpGenius Job Listing Cross-Site Scripting (1.0.2)
WordPress Plugin ProfileGrid-User Profiles, Groups and Communities Remote Code Execution (2.8.5)