Description
Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL.
Remediation
References
Related Vulnerabilities
WordPress Plugin BSK PDF Manager Multiple Cross-Site Scripting Vulnerabilities (1.3)
Django Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-0305)
WordPress Plugin WooCommerce-Store Toolkit Privilege Escalation (1.5.7)
MySQL CVE-2018-2583 Vulnerability (CVE-2018-2583)
PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2015-8994)