Description

Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.

Remediation

References

CVE-2012-2401

Related Vulnerabilities

WordPress Ultimate Member Plugin Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2024-8520)

WordPress Plugin PHP Everywhere Multiple Remote Code Execution Vulnerabilities (2.0.3)

WordPress Plugin CF7 Invisible reCAPTCHA Cross-Site Scripting (1.3.1)

Nginx CVE-2011-4963 Vulnerability (CVE-2011-4963)

WordPress Plugin BJ Lazy Load Remote Code Execution (0.7.5)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2012-2401