CVE-2014-4535

MEDIUMNuclei

import_legacy_media_project import_legacy_media Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2014-4535 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Cross-site scripting (XSS) vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 19, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

import_legacy_media

Browse import_legacy_media_project / import_legacy_media
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMImport Legacy Media <= 0.1 - Cross-Site ScriptingCVSS 6.1

A cross-site scripting vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php.

Impact

Successful exploitation of this vulnerability could lead to the execution of arbitrary script code in the context of the affected website, potentially allowing an attacker to steal sensitive information or perform unauthorized actions.

Remediation

Update to the latest version of the Import Legacy Media plugin (0.1 or higher) to mitigate this vulnerability.

WeaknessesCWE-79
Authorsdaffainfo
Template tagscve2014cvewpscanwordpresswp-pluginxssunauthimport_legacy_media_projectvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:import_legacy_media_project:import_legacy_media:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/7fb78d3c-f784-4630-ad92-d33e5de814fd https://nvd.nist.gov/vuln/detail/CVE-2014-4535 http://codevigilant.com/disclosure/wp-plugin-import-legacy-media-a3-cross-site-scripting-xss https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2