XSS in Wordpress
CVE-2015-3439
Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.061 (92.7th percentile) — read the EPSS interpretation.
Affected products
- Wordpress — versions 3.9.0, 3.9.1, 3.9.2
- Debian Debian_linux — versions 7.0, 8.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@debian.org (Exploit, x_refsource_MISC)
- security@debian.org (vendor-advisory, x_refsource_FEDORA)
- security@debian.org (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security@debian.org (x_refsource_MISC)
- security@debian.org (vdb-entry, x_refsource_BID)
- security@debian.org (vendor-advisory, x_refsource_FEDORA)
- security@debian.org (vdb-entry, x_refsource_SECTRACK)
- security@debian.org (x_refsource_CONFIRM)
- security@debian.org (vendor-advisory, x_refsource_DEBIAN)
- security@debian.org (x_refsource_CONFIRM, Exploit, Patch)
Frequently asked questions
- What is CVE-2015-3439?
- CVE-2015-3439 is a vulnerability in Wordpress, classified under Cross-site Scripting. Published 2015-08-05.
- Is CVE-2015-3439 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.