CVE-2016-9263
MEDIUMWordPress < 4.8.2 - Cross-Domain Flash Injection via flashmediaelement.swf
Title source: llmDescription
WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/101294
Mitigation, Third Party Advisory x_refsource_misc
https://opnsec.com/2017/10/cve-2016-9263-unpatched-xsf-vulnerability-in-wordpress/
Scores
CVSS v3
4.7
EPSS
0.0124
EPSS Percentile
79.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-20
Status
published
Products (1)
wordpress/wordpress
< 4.8.2
Published
Oct 12, 2017
Tracked Since
Feb 18, 2026