Cross-Site Scripting (XSS)

2017-08-0406:13:10

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

EPSS

0.003

Percentile

70.8%

JSON

WordPress is vulnerable to cross-site scripting (XSS) attacks. The attack exists because the unfiltered_html capability is ignored in the map_meta_cap function of wp-includes/capabilities.php when the multisite feature is used.

References

codex.wordpress.org/Version_3.4.1

codex.wordpress.org/Version_3.4.2

core.trac.wordpress.org/changeset?old_path=%2Ftags%2F3.4.1&old=21780&new_path=%2Ftags%2F3.4.2&new=21780#file23

core.trac.wordpress.org/changeset?reponame=&new=21153%40branches%2F3.4&old=21076%40trunk#file16

openwall.com/lists/oss-security/2012/09/12/17

www.openwall.com/lists/oss-security/2012/07/02/1

www.openwall.com/lists/oss-security/2012/07/08/1

codex.wordpress.org/Version_3.4.2

core.trac.wordpress.org/changeset?old_path=%2Ftags%2F3.4.1&old=21780&new_path=%2Ftags%2F3.4.2&new=21780#file18

EPSS

0.003

Percentile

70.8%

JSON

Related for VERACODE:4859