CVE-2014-9031

WordPress < 3.7.5, 3.8.x < 3.8.5, 3.9.x < 3.9.3 - Cross-Site Scripting via Shortcode Brackets

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field, as demonstrated by a comment or a post.

References (9)

Core 9
Core References
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Nov/62
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-3085
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2014/11/25/12
Third Party Advisory x_refsource_confirm
http://advisories.mageia.org/MGASA-2014-0493.html
Various Sources x_refsource_misc
http://klikki.fi/adv/wordpress.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1031243
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/71237
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2014:233
Patch, Vendor Advisory x_refsource_confirm
https://wordpress.org/news/2014/11/wordpress-4-0-1/

Scores

EPSS 0.0060
EPSS Percentile 69.7%

Details

CWE
CWE-79
Status published
Products (9)
wordpress/wordpress 3.8
wordpress/wordpress 3.8.1
wordpress/wordpress 3.8.2
wordpress/wordpress 3.8.3
wordpress/wordpress 3.8.4
wordpress/wordpress 3.9
wordpress/wordpress 3.9.1
wordpress/wordpress 3.9.2
wordpress/wordpress < 3.7.4
Published Nov 25, 2014
Tracked Since Feb 18, 2026