Cross-Site Scripting (XSS)

2017-08-0406:13:10

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

70.8%

JSON

WordPress is vulnerable to cross-site scripting (XSS) attacks. The attack exists because the unfiltered_html capability is ignored in the map_meta_cap function of wp-includes/capabilities.php when the multisite feature is used.

CPENameOperatorVersion
johnpbloch/wordpress-corele3.4.1

CPE	Name	Operator	Version
	johnpbloch/wordpress-core	le	3.4.1

References

codex.wordpress.org/Version_3.4.1

codex.wordpress.org/Version_3.4.2

core.trac.wordpress.org/changeset?old_path=%2Ftags%2F3.4.1&old=21780&new_path=%2Ftags%2F3.4.2&new=21780#file23

core.trac.wordpress.org/changeset?reponame=&new=21153%40branches%2F3.4&old=21076%40trunk#file16

openwall.com/lists/oss-security/2012/09/12/17

www.openwall.com/lists/oss-security/2012/07/02/1

www.openwall.com/lists/oss-security/2012/07/08/1

codex.wordpress.org/Version_3.4.2

core.trac.wordpress.org/changeset?old_path=%2Ftags%2F3.4.1&old=21780&new_path=%2Ftags%2F3.4.2&new=21780#file18

0.003 Low

EPSS

Percentile

70.8%

JSON

Related for VERACODE:4859