Description
The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks by leveraging the Administrator or Editor role and composing crafted text.
Remediation
References
Related Vulnerabilities
WordPress Plugin YOP Poll Multiple Cross-Site Scripting Vulnerabilities (6.3.0)
Oracle Database Server CVE-2015-0479 Vulnerability (CVE-2015-0479)
Drupal Incorrect Authorization Vulnerability (CVE-2022-25274)
WordPress Plugin Elementor Pro Security Bypass (3.11.6)
WordPress Plugin JiangQie Official Website Mini Program SQL Injection (1.1.0)