CVE-2016-6634

MEDIUM

WordPress < 4.4.4 - Cross-Site Scripting in Network Settings Page

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/92390
Third Party Advisory, VDB Entry x_refsource_misc
https://wpvulndb.com/vulnerabilities/8474
Patch, Release Notes x_refsource_confirm
http://codex.wordpress.org/Version_4.5
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3681

Scores

CVSS v3 6.1
EPSS 0.0078
EPSS Percentile 73.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
wordpress/wordpress < 4.4.4
Published Aug 07, 2016
Tracked Since Feb 18, 2026