PT-2018-17139

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 4.9.2 Description: The issue concerns a cross-site scripting XSS problem in the Flash fallback files in MediaElement, located under wp-includes/js/mediaelement. Recommendations: For WordPress versions prior to 4.9....

PT-2017-10032

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.8.3 Description The issue allows remote attackers to conduct cross-domain Flash injection XSF attacks by leveraging code contained within the flashmediaelement.swf file in wp-includes/js/mediaelement/, when...

CVE-2017-6814: Improper Neutralization of Input During Web Page Generation

In WordPress before 4.7.3, there is authenticated Cross-Site Scripting XSS via Media File Metadata. This is demonstrated by both 1 mishandling of the playlist shortcode in the wpplaylistshortcode function in wp-includes/media.php and 2 mishandling of meta information in the renderTracks function ...