CVE-2016-4566

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

6.16%

Published

May 21, 2016

Modified

May 6, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.

Weaknesses (CWE)

CWE-79

Affected Products (2)

wordpress · wordpressvulnerable

plupload · pluploadvulnerable

References (16)

http://www.openwall.com/lists/oss-security/2016/05/07/2

http://www.plupload.com/punbb/viewtopic.php?pid=28690

Vendor Advisory

http://www.securitytracker.com/id/1035818

Third Party AdvisoryVDB Entry

https://codex.wordpress.org/Version_4.5.2

Patch

https://core.trac.wordpress.org/changeset/37382/

Patch

https://gist.github.com/cure53/09a81530a44f6b8173f545accc9ed07e

Third Party Advisory

https://wordpress.org/news/2016/05/wordpress-4-5-2/

PatchVendor Advisory

https://wpvulndb.com/vulnerabilities/8489

Third Party Advisory

http://www.openwall.com/lists/oss-security/2016/05/07/2

http://www.plupload.com/punbb/viewtopic.php?pid=28690

Vendor Advisory

http://www.securitytracker.com/id/1035818

Third Party AdvisoryVDB Entry

https://codex.wordpress.org/Version_4.5.2

Patch

https://core.trac.wordpress.org/changeset/37382/

Patch

https://gist.github.com/cure53/09a81530a44f6b8173f545accc9ed07e

Third Party Advisory

https://wordpress.org/news/2016/05/wordpress-4-5-2/

PatchVendor Advisory

https://wpvulndb.com/vulnerabilities/8489

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs