CVE-2015-4338
XCloner 3.1.2 - Authenticated PHP Code Injection via Translation Language Field
Title source: llmDescription
Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LM_FRONT_* field for a language, as demonstrated by language/italian.php.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/74943
Exploit, Third Party Advisory x_refsource_misc
http://packetstormsecurity.com/files/132107/WordPress-XCloner-3.1.2-XSS-Command-Execution.html
Various Sources x_refsource_misc
http://www.vapid.dhs.org/advisory.php?v=121
Scores
EPSS
0.0232
EPSS Percentile
81.3%
Details
CWE
CWE-94
Status
published
Products (1)
xcloner/xcloner
3.1.2
Published
Jun 17, 2015
Tracked Since
Feb 18, 2026