Description

Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.

Remediation

References

CVE-2012-2401

Related Vulnerabilities

WordPress Plugin Form Maker by 10Web-Mobile-Friendly Drag & Drop Contact Form Builder SQL Injection (1.13.3)

WordPress Plugin VK Gallery TimThumb Arbitrary File Upload (1.1.0)

WordPress Plugin Gigya-Social Infrastructure Cross-Site Scripting (1.1.8)

WordPress Plugin DELUCKS SEO Unspecified Vulnerability (1.2.2)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-8132)

Severity

Medium

Classification

CVE-2012-2401 CWE-264

Tags

Missing Update Known Vulnerabilities