CVE-2014-9035 — Cross-site Scripting in Wordpress

CWE-79 — Cross-site Scripting5 documents5 sources

Severity

4.3MEDIUMNVD

EPSS

0.6%

top 30.90%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Wordpress Debian Wordpress Debian Linux

Timeline

PublishedNov 25

Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 4.0.1+dfsg-1 (bookworm)

▶Debianwordpress/wordpress< 4.0.1+dfsg-1+3

▶NVDwordpress/wordpress3.7.4+9

Also affects: Debian Linux 7.0, 8.0

Patches

Patch: wordpress.org ↗Patch: wordpress.org ↗

🔴Vulnerability Details

GHSA

GHSA-h62c-3j33-j9pq: Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3↗2022-05-17

▶

OSV

CVE-2014-9035: Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3↗2014-11-25

▶

📋Vendor Advisories

Debian

CVE-2014-9035: wordpress - Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5...↗2014

▶

💬Community

Bugzilla

CVE-2014-9031 CVE-2014-9032 CVE-2014-9033 CVE-2014-9034 CVE-2014-9035 CVE-2014-9036 CVE-2014-9037 CVE-2014-9038 CVE-2014-9039 wordpress: security flaws fixed in the 4.0.1 release↗2014-11-21

▶