Published: 05/08/2015 Updated: 06/12/2016

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x prior to 4.1.2 and other products, allows remote malicious users to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 8.0
debian debian linux 7.0
wordpress wordpress 3.9.3
wordpress wordpress 4.0
wordpress wordpress 3.9.0
wordpress wordpress 4.1.1
wordpress wordpress 3.9.1
wordpress wordpress 3.9.2
wordpress wordpress 4.0.1
wordpress wordpress 4.1

Debian Bug report logs - #783347 wordpress: New critical security release available: 412 (CVE-2015-3438 CVE-2015-3439) Package: wordpress; Maintainer for wordpress is Craig Small <csmall@debianorg>; Source for wordpress is src:wordpress (PTS, buildd, popcon) Reported by: Christer Mjellem Strand <dilldall@bjorkorg> ...

Debian Bug report logs - #783554 wordpress: New critical security release available: 421 (CVE-2015-3440) Package: src:wordpress; Maintainer for src:wordpress is Craig Small <csmall@debianorg>; Reported by: Craig Small <csmall@debianorg> Date: Mon, 27 Apr 2015 22:24:02 UTC Severity: important Tags: security Found ...

Multiple security issues have been discovered in Wordpress, a weblog manager, that could allow remote attackers to upload files with invalid or unsafe names, mount social engineering attacks or compromise a site via cross-site scripting, and inject SQL commands More information can be found in the upstream advisories at wordpressorg/news/ ...

CWE-79 http://codex.wordpress.org/Version_4.1.2 https://core.trac.wordpress.org/changeset/32168 https://wordpress.org/news/2015/04/wordpress-4-1-2/http://zoczus.blogspot.com/2015/04/plupload-same-origin-method-execution.html http://www.debian.org/security/2015/dsa-3250 https://wpvulndb.com/vulnerabilities/7933 http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158271.html http://www.securitytracker.com/id/1032207 http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158278.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html http://www.securityfocus.com/bid/74269 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783347 https://www.debian.org/security/./dsa-3250

CVE-2015-3439

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect