MediaElement Vulnerable to Reflected XSS

MEDIUM 6.1CVE-2016-4567 · GHSA-277w-qpxr-2549 · Published 22/05/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
contao-components/mediaelement Packagist	`≥ 2.14.2, < 2.21.1`	`2.21.1`
contao/core Packagist	`≥ 3.0.0, < 3.5.15`	`3.5.15`
mediaelement.js mediaelementjs	`≤ 2.20.1`	No fix yet
wordpress wordpress	`≤ 4.5.1`	No fix yet
mediaelement npm	`< 2.11.1`	`2.11.1`

Description

Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.swf in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."

NVD description

Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."

References

nvd.nist.gov/vuln/detail/CVE-2016-4567 · ADVISORY
johndyer/mediaelement commit 34834ee · WEB
mediaelement/mediaelement commit 34834ee · WEB
codex.wordpress.org/Version_4.5.2 · WEB
contao.org/en/news/contao-3_5_15.html · WEB
core.trac.wordpress.org/changeset/37371 · WEB
gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c · WEB
FriendsOfPHP/security-advisories · WEB
FriendsOfPHP/security-advisories · WEB
johndyer/mediaelement · WEB
mediaelement/mediaelement

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free