Description

Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field, as demonstrated by a comment or a post.

Remediation

References

CVE-2014-9031

Related Vulnerabilities

Perl Improper Input Validation Vulnerability (CVE-2015-8853)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-6658)

WebLogic Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2020-8908)

IBMHttpServer Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-1360)

WordPress Plugin Deny All Firewall Cross-Site Request Forgery (1.1.6)

Severity

Medium

Classification

CVE-2014-9031 CWE-707

Tags

Missing Update Known Vulnerabilities