Cross-Site Scripting Vulnerabilities in Media File Renamer Plugin for WordPress
CVE-2014-2040

Currently unrated

Key Information:

Vendor

Wordpress
Status
Media File Renamer
Vendor
CVE Published:
3 March 2014

What is CVE-2014-2040?

The Media File Renamer plugin for WordPress contains multiple cross-site scripting (XSS) vulnerabilities in its callback functions, specifically in mfrh_class.settings-api.php. Remote authenticated users who have permissions to add or edit media can exploit these vulnerabilities to inject arbitrary web scripts or HTML. This can be achieved through unspecified parameters, such as the title of uploaded files, potentially leading to unauthorized actions or data exposure on affected WordPress sites.

References

http://www.vapid.dhs.org/advisories/wordpress/plugins/Med...
x_refsource_MISC
http://www.securityfocus.com/archive/1/531270/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/65715
vdb-entryx_refsource_BID

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.