CVE-2014-9094: XSS

Published Nov 26, 2014

Updated

Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.

Affected Software

1 affected component

Digitalzoomstudio Video Gallery Wordpress

Event History

Nov 26, 2014

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-9094?

CVE-2014-9094 has a medium severity rating due to its potential for exploitation through cross-site scripting.

How do I fix CVE-2014-9094?

To fix CVE-2014-9094, update the Digital Zoom Studio Video Gallery plugin to the latest version where the vulnerability is patched.

What are the affected parameters in CVE-2014-9094?

The affected parameters in CVE-2014-9094 are swfloc and designrand.

Who is impacted by CVE-2014-9094?

Any WordPress site using the Digital Zoom Studio Video Gallery plugin is impacted by CVE-2014-9094.

Can CVE-2014-9094 lead to information theft?

Yes, CVE-2014-9094 can potentially lead to information theft through the injection of arbitrary scripts.