CVE-2014-4030

published 2014-06-25

CVE-2014-4030: Cross-site request forgery (CSRF) vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of…

Priority P4 34 medium 6.8 CVSS 2.0

AV N AC M Au N C P I P A P

EXPLOIT

Cross-site request forgery (CSRF) vulnerability in the JW Player plugin before 2.1.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that remove players via a delete action to wp-admin/admin.php.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
longtailvideo	jw_player_for_flash_html5_video_plugin	<= 2.1.3	—
longtailvideo	jw_player_for_flash_html5_video_plugin	—	—
longtailvideo	jw_player_for_flash_html5_video_plugin	—	—
longtailvideo	jw_player_for_flash_html5_video_plugin	—	—
longtailvideo	jw_player_for_flash_html5_video_plugin	—	—
longtailvideo	jw_player_for_flash_html5_video_plugin	—	—
longtailvideo	jw_player_for_flash_html5_video_plugin	—	—
longtailvideo	jw_player_for_flash_html5_video_plugin	—	—
longtailvideo	jw_player_for_flash_html5_video_plugin	—	—
longtailvideo	jw_player_for_flash_html5_video_plugin	—	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-352