Scripting Vulnerability in Plupload for WordPress

CVE-2012-2401

What is CVE-2012-2401?

Plupload versions prior to 1.5.4, as integrated into WordPress prior to version 3.3.2, are susceptible to a cross-site scripting vulnerability. This flaw allows remote attackers to exploit the Same Origin Policy by embedding malicious content in their SWF files. Consequently, this enables unauthorized access to sensitive information and could potentially lead to further exploitation of the web application. It is crucial for users to update their installations to mitigate risks associated with this vulnerability.

References