WordPress 3.7-4.9.1 - MediaElement Cross-Site Scripting (XSS)

Description An XSS vulnerability was discovered in the Flash fallback files in MediaElement, a library that is included with WordPress. Because the Flash files are no longer needed for most use cases, they have been removed from WordPress...

WordPress 3.7-4.9.1 - Cross-Site Scripting vulnerability

Cross-Site Scripting vulnerability found in WordPress 3.7-4.9.1 versions in the Flash fallback files in MediaElement, a library that is included with WordPress. Solution Update your Wordpress to the latest available version at least 4.9.2...

WordPress: MediaElements XSS

The reporter disclosed a reflected XSS vulnerability in MediaElement's Flash files, which are bundled in WordPress. MediaElement and WordPress released versions 4.2.8 and 4.9.2, respectively, which resolve the issue...

PT-2017-10032

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.8.3 Description The issue allows remote attackers to conduct cross-domain Flash injection XSF attacks by leveraging code contained within the flashmediaelement.swf file in wp-includes/js/mediaelement/, when...

WordPress: Multiple stored XSS in WordPress

Enguerran discovered a way to store payloads that would trigger XSS in the MediaElement Flash and Silverlight files that were bundled with WordPress. We coordinated a fix with MediaElement, and moved the files from WordPress Core to an optional plugin, since most users no longer needed them...

CVE-2017-6814

In WordPress before 4.7.3, there is authenticated Cross-Site Scripting XSS via Media File Metadata. This is demonstrated by both 1 mishandling of the playlist shortcode in the wpplaylistshortcode function in wp-includes/media.php and 2 mishandling of meta information in the renderTracks function ...

CVE-2017-6814

In WordPress before 4.7.3, there is authenticated Cross-Site Scripting XSS via Media File Metadata. This is demonstrated by both 1 mishandling of the playlist shortcode in the wpplaylistshortcode function in wp-includes/media.php and 2 mishandling of meta information in the renderTracks function ...

CVE-2017-6814

In WordPress before 4.7.3, there is authenticated Cross-Site Scripting XSS via Media File Metadata. This is demonstrated by both 1 mishandling of the playlist shortcode in the wpplaylistshortcode function in wp-includes/media.php and 2 mishandling of meta information in the renderTracks function ...

CVE-2017-6814: Improper Neutralization of Input During Web Page Generation

In WordPress before 4.7.3, there is authenticated Cross-Site Scripting XSS via Media File Metadata. This is demonstrated by both 1 mishandling of the playlist shortcode in the wpplaylistshortcode function in wp-includes/media.php and 2 mishandling of meta information in the renderTracks function ...

Cross-site Scripting (XSS)

mediaelement is vulnerable to cross-site scripting XSS attacks. The library does not sanitize user input, allowing a malicious user to inject and execute arbitrary code...

news.ladbrokes.com XSS vulnerability

Open Bug Bounty ID: OBB-189259 Description| Value ---|--- Affected Website:| news.ladbrokes.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

es.nethive.com XSS vulnerability

Vulnerable URL: https://es.nethive.com/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alert%60OPENBUGBOUNTY%60 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

press.parkwind.eu XSS vulnerability

Vulnerable URL: https://press.parkwind.eu/blog/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alert%60OPENBUGBOUNTY%60 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...

pers.livecomedy.be XSS vulnerability

Vulnerable URL: https://pers.livecomedy.be/blog/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alert%60OPENBUGBOUNTY%60 Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...

emirates.com XSS vulnerability

Vulnerable URL: http://www.emirates.com/media-centre/blog/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alert%60OPENBUGBOUNTY%60 Details: Description| Value ---|--- Patched:| Yes, at 24.08.2016 Latest check for patch:| 24.08.2016 03:50 GMT Vulnerability type:| XSS Vulnerabili...

drpimplepopper.com XSS vulnerability

Open Bug Bounty ID: OBB-169912 Description| Value ---|--- Affected Website:| drpimplepopper.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

orthodonticsolution.com XSS vulnerability

Open Bug Bounty ID: OBB-165370 Description| Value ---|--- Affected Website:| orthodonticsolution.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

museomaranello.ferrari.com XSS vulnerability

Vulnerable URL: http://museomaranello.ferrari.com/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Ran...

allegro.naszkornik.pl XSS vulnerability

Open Bug Bounty ID: OBB-154644 Description| Value ---|--- Affected Website:| allegro.naszkornik.pl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

optus-labs.com XSS vulnerability

Vulnerable URL: http://optus-labs.com/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alertOPENBUGBOUNTY Details: Description| Value ---|--- Patched:| Yes, at 04.04.2017 Latest check for patch:| 04.04.2017 02:00 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...