Description
The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks by leveraging the Administrator or Editor role and composing crafted text.
Remediation
References
Related Vulnerabilities
PleskWin URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2023-24044)
Apache Tomcat Other Vulnerability (CVE-2023-45648)
WordPress Plugin Contest Gallery-Photo Contest for WordPress Security Bypass (13.1.0.6)
MySQL CVE-2014-2438 Vulnerability (CVE-2014-2438)
PHP Address Book Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2013-2778)