VulnerabilityModified
CVE-2014-4932
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.
MEDIUM 6.1EPSS 1.19%
Does this matter?
Lower severity and a low EPSS score (1.19%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.
- CVSS 3.0
- 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.19% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- wordfence/wordfence security
- Source
- cve@mitre.org
References
- http://techdefencelabs.com/security-advisories.htmlThird Party Advisory
- https://www.wordfence.com/help/advanced/changelog/Release Notes, Vendor Advisory
- http://techdefencelabs.com/security-advisories.htmlThird Party Advisory
- https://www.wordfence.com/help/advanced/changelog/Release Notes, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.