Description

The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks by leveraging the Administrator or Editor role and composing crafted text.

Remediation

References

CVE-2012-3383

Related Vulnerabilities

Liferay DXP Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2024-26265)

LimeSurvey Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2025-41075)

PleskLin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-11583)

Oracle JRE CVE-2022-21340 Vulnerability (CVE-2022-21340)

Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2009-4297)

Severity

Low

Classification

CVE-2012-3383 CWE-264

Tags

Missing Update Known Vulnerabilities