CVE-2014-5240

Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL.

Published: Aug 18, 2014
Updated: Apr 13, 2023
CVE: CVE-2014-5240
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 2.1
AV:N/AC:H/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
WordPress / wordpress	3.0.5	3.0.5.x
WordPress / wordpress	3.4.0	3.4.0.x
WordPress / wordpress	3.6.1	3.6.1.x
WordPress / wordpress	3.7	3.7.x
WordPress / wordpress	3.5.0	3.5.0.x
WordPress / wordpress	3.0.2	3.0.2.x
WordPress / wordpress	3.2.1	3.2.1.x
WordPress / wordpress	3.1.4	3.1.4.x
WordPress / wordpress	3.0	3.0.x
WordPress / wordpress	3.2	3.2.x
WordPress / wordpress	3.3.3	3.3.3.x
WordPress / wordpress	-	3.9.1.x
WordPress / wordpress	3.0.1	3.0.1.x
WordPress / wordpress	3.9.0	3.9.0.x
WordPress / wordpress	3.7.1	3.7.1.x
WordPress / wordpress	3.1.3	3.1.3.x
WordPress / wordpress	3.0.4	3.0.4.x
WordPress / wordpress	3.1	3.1.x
WordPress / wordpress	3.6	3.6.x
WordPress / wordpress	3.2-beta1	3.2-beta1.x
WordPress / wordpress	3.3.2	3.3.2.x
WordPress / wordpress	3.1.2	3.1.2.x
WordPress / wordpress	3.0.6	3.0.6.x
WordPress / wordpress	3.3.1	3.3.1.x
WordPress / wordpress	3.8	3.8.x
WordPress / wordpress	3.1.1	3.1.1.x
WordPress / wordpress	3.8.1	3.8.1.x
WordPress / wordpress	3.3	3.3.x
WordPress / wordpress	3.5.1	3.5.1.x
WordPress / wordpress	3.4.2	3.4.2.x
WordPress / wordpress	3.4.1	3.4.1.x
WordPress / wordpress	3.0.3	3.0.3.x
debian / debian_linux	7.0	7.0.x

Vulnerability Database

290,020

CVE-2014-5240