Description

Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL.

Remediation

References

CVE-2014-5240

Related Vulnerabilities

e107 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-4757)

MySQL CVE-2019-2797 Vulnerability (CVE-2019-2797)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-33332)

Apache HTTP Server Other Vulnerability (CVE-2001-0042)

WordPress Plugin weForms-Easy Drag & Drop Contact Form Builder For WordPress CSV Injection (1.6.3)

Severity

Low

Classification

CVE-2014-5240 CWE-707

Tags

Missing Update Known Vulnerabilities