WordPress Vulnerabilities

WordPress 3.7-4.9.1 - MediaElement Cross-Site Scripting (XSS)

Description

An XSS vulnerability was discovered in the Flash fallback files in MediaElement, a library that is included with WordPress. Because the Flash files are no longer needed for most use cases, they have been removed from WordPress.

Affects WordPress

3.8.1
Fixed in WordPress 3.8.25
3.8
Fixed in WordPress 3.8.25
3.7.1
Fixed in WordPress 3.7.25
3.9
Fixed in WordPress 3.9.23
3.9.1
Fixed in WordPress 3.9.23
3.7
Fixed in WordPress 3.7.25
3.8.2
Fixed in WordPress 3.8.25
3.8.3
Fixed in WordPress 3.8.25
3.9.2
Fixed in WordPress 3.9.23
4.0
Fixed in WordPress 4.0.22
4.1
Fixed in WordPress 4.1.22
4.1.1
Fixed in WordPress 4.1.22
4.2
Fixed in WordPress 4.9.2
3.9.3
Fixed in WordPress 3.9.23
4.1.2
Fixed in WordPress 4.1.22
4.2.1
Fixed in WordPress 4.9.2
4.0.1
Fixed in WordPress 4.0.22
4.1.5
Fixed in WordPress 4.1.22
4.1.4
Fixed in WordPress 4.1.22
4.1.3
Fixed in WordPress 4.1.22
3.8.4
Fixed in WordPress 3.8.25
3.7.4
Fixed in WordPress 3.7.25
4.2.3
Fixed in WordPress 4.9.2
3.8.8
Fixed in WordPress 3.8.25
3.8.5
Fixed in WordPress 3.8.25
3.8.6
Fixed in WordPress 3.8.25
3.8.7
Fixed in WordPress 3.8.25
3.7.2
Fixed in WordPress 3.7.25
3.7.3
Fixed in WordPress 3.7.25
3.7.5
Fixed in WordPress 3.7.25
3.7.6
Fixed in WordPress 3.7.25
3.7.7
Fixed in WordPress 3.7.25
3.7.8
Fixed in WordPress 3.7.25
3.7.9
Fixed in WordPress 3.7.25
3.8.9
Fixed in WordPress 3.8.25
3.9.4
Fixed in WordPress 3.9.23
3.9.5
Fixed in WordPress 3.9.23
3.9.6
Fixed in WordPress 3.9.23
3.9.7
Fixed in WordPress 3.9.23
4.0.2
Fixed in WordPress 4.0.22
4.0.3
Fixed in WordPress 4.0.22
4.0.4
Fixed in WordPress 4.0.22
4.0.5
Fixed in WordPress 4.0.22
4.0.6
Fixed in WordPress 4.0.22
4.1.6
Fixed in WordPress 4.1.22
4.2.2
Fixed in WordPress 4.2.19
4.2.4
Fixed in WordPress 4.2.19
4.1.7
Fixed in WordPress 4.1.22
4.0.7
Fixed in WordPress 4.0.22
3.9.8
Fixed in WordPress 3.9.23
3.8.10
Fixed in WordPress 3.8.25
3.7.10
Fixed in WordPress 3.7.25
4.3
Fixed in WordPress 4.3.15
4.3.1
Fixed in WordPress 4.3.15
4.2.5
Fixed in WordPress 4.2.19
4.1.8
Fixed in WordPress 4.1.22
4.0.8
Fixed in WordPress 4.0.22
3.9.9
Fixed in WordPress 3.9.23
3.8.11
Fixed in WordPress 3.8.25
3.7.11
Fixed in WordPress 3.7.25
4.4
Fixed in WordPress 4.4.14
3.7.12
Fixed in WordPress 3.7.25
3.8.12
Fixed in WordPress 3.8.25
3.9.10
Fixed in WordPress 3.9.23
4.0.9
Fixed in WordPress 4.0.22
4.1.9
Fixed in WordPress 4.1.22
4.2.6
Fixed in WordPress 4.2.19
4.3.2
Fixed in WordPress 4.3.15
4.4.1
Fixed in WordPress 4.4.14
4.4.2
Fixed in WordPress 4.4.14
4.3.3
Fixed in WordPress 4.3.15
4.2.7
Fixed in WordPress 4.2.19
4.1.10
Fixed in WordPress 4.1.22
4.0.10
Fixed in WordPress 4.0.22
3.9.11
Fixed in WordPress 3.9.23
3.8.13
Fixed in WordPress 3.8.25
3.7.13
Fixed in WordPress 3.7.25
4.5
Fixed in WordPress 4.5.13
4.5.1
Fixed in WordPress 4.5.13
3.7.14
Fixed in WordPress 3.7.25
3.8.14
Fixed in WordPress 3.8.25
3.9.12
Fixed in WordPress 3.9.23
4.0.11
Fixed in WordPress 4.0.22
4.1.11
Fixed in WordPress 4.1.22
4.2.8
Fixed in WordPress 4.2.19
4.3.4
Fixed in WordPress 4.3.15
4.4.3
Fixed in WordPress 4.4.14
4.5.2
Fixed in WordPress 4.5.13
4.5.3
Fixed in WordPress 4.5.13
3.7.15
Fixed in WordPress 3.7.25
3.8.15
Fixed in WordPress 3.8.25
3.9.13
Fixed in WordPress 3.9.23
4.0.12
Fixed in WordPress 4.0.22
4.1.12
Fixed in WordPress 4.1.22
4.2.9
Fixed in WordPress 4.2.19
4.3.5
Fixed in WordPress 4.3.15
4.4.4
Fixed in WordPress 4.4.14
4.6
Fixed in WordPress 4.6.10
3.7.16
Fixed in WordPress 3.7.25
3.8.16
Fixed in WordPress 3.8.25
3.9.14
Fixed in WordPress 3.9.23
4.0.13
Fixed in WordPress 4.0.22
4.1.13
Fixed in WordPress 4.1.22
4.2.10
Fixed in WordPress 4.2.19
4.3.6
Fixed in WordPress 4.3.15
4.4.5
Fixed in WordPress 4.4.14
4.5.4
Fixed in WordPress 4.5.13
4.6.1
Fixed in WordPress 4.6.10
4.7
Fixed in WordPress 4.7.9
3.7.17
Fixed in WordPress 3.7.25
3.8.17
Fixed in WordPress 3.8.25
3.9.15
Fixed in WordPress 3.9.23
4.0.14
Fixed in WordPress 4.0.22
4.1.14
Fixed in WordPress 4.1.22
4.2.11
Fixed in WordPress 4.2.19
4.3.7
Fixed in WordPress 4.3.15
4.4.6
Fixed in WordPress 4.4.14
4.5.5
Fixed in WordPress 4.5.13
4.7.1
Fixed in WordPress 4.7.9
4.6.2
Fixed in WordPress 4.6.10
3.7.18
Fixed in WordPress 3.7.25
3.8.18
Fixed in WordPress 3.8.25
3.9.16
Fixed in WordPress 3.9.23
4.0.15
Fixed in WordPress 4.0.22
4.1.15
Fixed in WordPress 4.1.22
4.2.12
Fixed in WordPress 4.2.19
4.3.8
Fixed in WordPress 4.3.15
4.4.7
Fixed in WordPress 4.4.14
4.5.6
Fixed in WordPress 4.5.13
4.6.3
Fixed in WordPress 4.6.10
4.7.2
Fixed in WordPress 4.7.9
3.7.19
Fixed in WordPress 3.7.25
3.8.19
Fixed in WordPress 3.8.25
3.9.17
Fixed in WordPress 3.9.23
4.0.16
Fixed in WordPress 4.0.22
4.1.16
Fixed in WordPress 4.1.22
4.2.13
Fixed in WordPress 4.2.19
4.3.9
Fixed in WordPress 4.3.15
4.4.8
Fixed in WordPress 4.4.14
4.5.7
Fixed in WordPress 4.5.13
4.6.4
Fixed in WordPress 4.6.10
4.7.3
Fixed in WordPress 4.7.9
3.7.20
Fixed in WordPress 3.7.25
3.8.20
Fixed in WordPress 3.8.25
3.9.18
Fixed in WordPress 3.9.23
4.0.17
Fixed in WordPress 4.0.22
4.1.17
Fixed in WordPress 4.1.22
4.2.14
Fixed in WordPress 4.2.19
4.3.10
Fixed in WordPress 4.3.15
4.4.9
Fixed in WordPress 4.4.14
4.5.8
Fixed in WordPress 4.5.13
4.6.5
Fixed in WordPress 4.6.10
4.7.4
Fixed in WordPress 4.7.9
4.7.5
Fixed in WordPress 4.7.9
3.7.21
Fixed in WordPress 3.7.25
3.8.21
Fixed in WordPress 3.8.25
3.9.19
Fixed in WordPress 3.9.23
4.0.18
Fixed in WordPress 4.0.22
4.1.18
Fixed in WordPress 4.1.22
4.2.15
Fixed in WordPress 4.2.19
4.3.11
Fixed in WordPress 4.3.15
4.4.10
Fixed in WordPress 4.4.14
4.5.9
Fixed in WordPress 4.5.13
4.6.6
Fixed in WordPress 4.6.10
4.8
Fixed in WordPress 4.8.5
4.8.1
Fixed in WordPress 4.8.5
3.7.22
Fixed in WordPress 3.7.25
3.8.22
Fixed in WordPress 3.8.25
3.9.20
Fixed in WordPress 3.9.23
4.0.19
Fixed in WordPress 4.0.22
4.1.19
Fixed in WordPress 4.1.22
4.2.16
Fixed in WordPress 4.2.19
4.3.12
Fixed in WordPress 4.3.15
4.4.11
Fixed in WordPress 4.4.14
4.5.10
Fixed in WordPress 4.5.13
4.6.7
Fixed in WordPress 4.6.10
4.7.6
Fixed in WordPress 4.7.9
4.8.2
Fixed in WordPress 4.8.5
4.8.3
Fixed in WordPress 4.8.5
3.7.23
Fixed in WordPress 3.7.25
3.8.23
Fixed in WordPress 3.8.25
3.9.21
Fixed in WordPress 3.9.23
4.0.20
Fixed in WordPress 4.0.22
4.1.20
Fixed in WordPress 4.1.22
4.2.17
Fixed in WordPress 4.2.19
4.3.13
Fixed in WordPress 4.3.15
4.4.12
Fixed in WordPress 4.4.14
4.5.11
Fixed in WordPress 4.5.13
4.6.8
Fixed in WordPress 4.6.10
4.7.7
Fixed in WordPress 4.7.9
4.9
Fixed in WordPress 4.9.2
4.9.1
Fixed in WordPress 4.9.2
4.8.4
Fixed in WordPress 4.8.5
4.7.8
Fixed in WordPress 4.7.9
4.6.9
Fixed in WordPress 4.6.10
4.5.12
Fixed in WordPress 4.5.13
4.4.13
Fixed in WordPress 4.4.14
4.3.14
Fixed in WordPress 4.3.15
4.2.18
Fixed in WordPress 4.2.19
4.1.21
Fixed in WordPress 4.1.22
4.0.21
Fixed in WordPress 4.0.22
3.9.22
Fixed in WordPress 3.9.23
3.8.24
Fixed in WordPress 3.8.25
3.7.24
Fixed in WordPress 3.7.25

References

CVE
CVE-2018-5776
CVE
CVE-2016-9263
URL
https://github.com/WordPress/WordPress/commit/3fe9cb61ee71fcfadb5e002399296fcc1198d850
URL
https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/
URL
https://core.trac.wordpress.org/ticket/42720

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
6ac45244-9f09-4e9c-92f3-f339d450fe72

Timeline

Publicly Published
2018-01-17 (about 6 years ago)
Added
2018-01-17 (about 6 years ago)
Last Updated
2020-09-22 (about 3 years ago)

Other

Published
Title
Published
2022-05-17
Title
Advanced Admin Search < 1.1.6 - Reflected Cross-Site Scripting
Published
2014-08-01
Title
WP Realty - index_ext.php listing_id Parameter Reflected XSS
Published
2024-04-25
Title
XStore < 9.3.9 - Reflected Cross-Site Scripting
Published
2023-01-30
Title
WP Email Capture < 3.10 - Admin+ Stored XSS
Published
2023-02-27
Title
Darcie < 1.1.6 - Reflected XSS