CVE-2016-9263

WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF)…

published October 12, 2017

CVSS
—
EPSS
2%
Percentile
82.1
In the wild
Unconfirmed
What it is

WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02175 · 82.1th percentile
Published
2017-10-12T16:00Z
EPSS history
Timeline
  • 12 OCT 16:00Z
    WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF)…
    cvelistv5