Description

Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.

Remediation

References

CVE-2017-14726

Related Vulnerabilities

WordPress Plugin DMSGuestbook File Manipulation (1.17.4)

WordPress Plugin Wufoo Shortcode Cross-Site Scripting (1.47)

Apache Tomcat Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2002-2272)

Serendipity Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2016-10752)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-0800)

Severity

Medium

Classification

CVE-2017-14726 CWE-707 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities