• YUI is a free, open source JavaScript and CSS library for building richly interactive web applications. <br/><br/> A security vulnerability was discovered by @soiaxx in YUI 2 involving self-hosted uploader.swf files. This vulnerability impacts YUI 2 versions 2.5.0 through 2.9.0 and allows arbitrary JavaScript to be run by passing in a query string parameter such as this one: <br/><br/> <code> uploader.swf?allowedDomain=\%22}%29%29%29}catch%28e%29{alert%28document.domain%29;}// </code> <br/> <br/> This problem is not reproducible in YUI 3.

• If you are using or even merely hosting any YUI 2 .swf file, please take steps to remove these files immediately from your hosts. <br/> YUI 2 is an end-of-lifed project and is no longer supported. All YUI 2 .swf files have been removed from the Yahoo CDN. If your site was taking advantage of the presence of these files on the Yahoo CDN they will no longer be available.

• • Security Bulletin: Addressing a Vulnerability in YUI 2.5.0 through YUI 2.9.0
  • YUI 'uploader.swf' Cross Site Scripting Vulnerability
  • YUI Security Issue found in uploader.swf

• 

• CVE-2013-6780

• CWE-79

• CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

• XSS

• WordPress Plugin Jammer Cross-Site Scripting (0.2)
• WordPress 3.9.x Cross-Site Scripting Vulnerability (3.9 - 3.9.9)
• WordPress Plugin WP-Paginate Cross-Site Scripting (1.2.1)
• WordPress Plugin Social Media Flying Icons-Floating Social Media Icon Cross-Site Scripting (2.1)
• WordPress Plugin wp-picasa-image Cross-Site Scripting (1.0)