CVE-2016-9263 — Improper Input Validation in Wordpress

CWE-20 — Improper Input Validation5 documents5 sources
Severity
4.7MEDIUMNVD
EPSS
1.2%
top 20.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
WordpressDebian Wordpress
Timeline
PublishedOct 12
Latest updateMay 17

Description

WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 1.6 | Impact: 2.7

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 4.1+dfsg-1 (bookworm)
▶Debianwordpress/wordpress< 4.1+dfsg-1+3

🔴Vulnerability Details

2
GHSA
GHSA-94pj-jgcq-pjjg: WordPress through 4↗2022-05-17
▶
OSV
CVE-2016-9263: WordPress through 4↗2017-10-12
▶

📋Vendor Advisories

1
Debian
CVE-2016-9263: wordpress - WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is n...↗2016
▶
CVE-2016-9263 — Improper Input Validation in Wordpress | cvebase