Veracode Vulnerability DatabaseVERACODE:4895Cross-Site Scripting (XSS)
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
WordPress is vulnerable to cross-site scripting (XSS) attacks. The attacks are possible because it does not filter the user supplied input to wptexturize() via a comment or a post.
References
advisories.mageia.org/MGASA-2014-0493.html
klikki.fi/adv/wordpress.html
openwall.com/lists/oss-security/2014/11/25/12
seclists.org/fulldisclosure/2014/Nov/62
www.debian.org/security/2014/dsa-3085
www.mandriva.com/security/advisories?name=MDVSA-2014:233
www.securityfocus.com/bid/71237
www.securitytracker.com/id/1031243
security-tracker.debian.org/tracker/CVE-2014-9031
wordpress.org/news/2014/11/wordpress-4-0-1/
Related
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N