Description

Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.

Remediation

References

CVE-2012-2401

Related Vulnerabilities

WordPress Plugin DukaPress Multiple Cross-Site Scripting Vulnerabilities (2.5.9)

WordPress Plugin Cookie Consent for WP-Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) CSV Injection (2.2.5)

WordPress Plugin Multiple Domain Cross-Site Scripting (1.0.2)

WordPress Plugin WP Google Review Slider Cross-Site Scripting (11.5)

Dot CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-3484)

Severity

Medium

Classification

CVE-2012-2401 CWE-264

Tags

Missing Update Known Vulnerabilities