CVE-2012-2399

WordPress < 3.3.1 - Cross-Site Scripting via SWFUpload buttonText Parameter

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.

References (15)

Core 15
Core References
Exploit, Third Party Advisory x_refsource_misc
http://packetstormsecurity.com/files/122399/tinymce11-xss.txt
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/75210
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/81459
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/49138
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/91134
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2012/dsa-2470
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/07/18/13
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/53192
Patch, Vendor Advisory x_refsource_confirm
http://wordpress.org/news/2012/04/wordpress-3-3-2/
Third Party Advisory third-party-advisory x_refsource_jvndb
http://jvndb.jvn.jp/jvndb/JVNDB-2012-002110
Third Party Advisory third-party-advisory x_refsource_jvn
http://jvn.jp/en/jp/JVN25280162/index.html
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2013/Mar/110

Scores

EPSS 0.0427
EPSS Percentile 89.0%

Details

Status published
Products (49)
wordpress/wordpress 0.71
wordpress/wordpress 1.0
wordpress/wordpress 1.0.1
wordpress/wordpress 1.0.2
wordpress/wordpress 1.1.1
wordpress/wordpress 1.2
wordpress/wordpress 1.2.1
wordpress/wordpress 1.2.2
wordpress/wordpress 1.2.3
wordpress/wordpress 1.2.4
... and 39 more
Published Apr 21, 2012
Tracked Since Feb 18, 2026