CVE-2012-2401

Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

3.38% chance of exploitation in the next 30 days, 88th percentile

Nuclei

medium

Published

2012-04-21

Updated

2024-08-06

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2012/CVE-2012-2401-wordpress-1a…

References

• CVE Record
• NVD entry

Related

• CVE-2012-2400
• CVE-2012-2402
• CVE-2012-2399
• CVE-2012-2403
• CVE-2012-2396
• CVE-2012-2404