CVE-2013-0237

Moxiecode Plupload < 1.5.4 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.

References (4)

[Product] http://codex.wordpress.org/Version_3.5.1

[Vendor Advisory] http://wordpress.org/news/2013/01/wordpress-3-5-1/

[Issue Tracking] https://bugzilla.redhat.com/show_bug.cgi?id=904122

[Exploit, Patch] https://github.com/moxiecode/plupload/commit/2d746ee9083c184f1234d8fed311e89bdd1b39e5

View Exploit ZIP pw:eip

Scores

EPSS 0.0043

EPSS Percentile 62.2%

Details

CWE

CWE-79

Status published

Products (50)

moxiecode/plupload < 1.5.4

moxiecode/plupload

... and 40 more

Published Jul 08, 2013

Tracked Since Feb 18, 2026