CVE-2016-4566

MEDIUM 6.1CVE-2016-4566 · Published 22/05/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
plupload plupload	`≤ 2.1.8`	No fix yet
wordpress wordpress	`≤ 4.5.1`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.

References

openwall.com/lists/oss-security/2016/05/07/2
plupload.com/punbb/viewtopic.php · Vendor Advisory
securitytracker.com/id/1035818 · Third Party Advisory
codex.wordpress.org/Version_4.5.2 · Patch
core.trac.wordpress.org/changeset/37382 · Patch
gist.github.com/cure53/09a81530a44f6b8173f545accc9ed07e · Third Party Advisory
wordpress.org/news/2016/05/wordpress-4-5-2 · Patch
wpvulndb.com/vulnerabilities/8489 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free