CVE-2014-4855

2014-07-1016:55:06

CWE-79

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

50.2%

JSON

Cross-site scripting (XSS) vulnerability in the Polylang plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to a user description. NOTE: some of these details are obtained from third party information.

Affected configurations

Nvd

Node

polylang_plugin_projectpolylangRange≤1.5.1wordpress

polylang_plugin_projectpolylangMatch1.5wordpress

VendorProductVersionCPE
polylang_plugin_projectpolylang*cpe:2.3:a:polylang_plugin_project:polylang:*:*:*:*:*:wordpress:*:*
polylang_plugin_projectpolylang1.5cpe:2.3:a:polylang_plugin_project:polylang:1.5:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
polylang_plugin_project	polylang	*	cpe:2.3:a:polylang_plugin_project:polylang::::::wordpress::*
polylang_plugin_project	polylang	1.5	cpe:2.3:a:polylang_plugin_project:polylang:1.5:::::wordpress::