CVE-2016-4567: Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2 (see CVE-2013-1967)
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
Other sources
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.swf in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
— GitHub
Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2 (see CVE-2013-1967)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/contao/coreto a version that resolves this vulnerability.Fixed in 3.5.15 - Upgrade
Upgrade
composer/contao-components/mediaelementto a version that resolves this vulnerability.Fixed in 2.21.1 - Upgrade
Upgrade
npm/mediaelementto a version that resolves this vulnerability.Fixed in 2.11.1
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4567?
CVE-2016-4567 is classified as a medium severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2016-4567?
To fix CVE-2016-4567, upgrade MediaElement.js to version 2.21.0 or later and WordPress to version 4.5.2 or later.
Which versions of WordPress are affected by CVE-2016-4567?
CVE-2016-4567 affects WordPress versions prior to 4.5.2.
What components are vulnerable in CVE-2016-4567?
The vulnerable components in CVE-2016-4567 include MediaElement.js versions from 2.14.2 up to 2.21.1.
Can CVE-2016-4567 be exploited by remote attackers?
Yes, CVE-2016-4567 can be exploited by remote attackers to inject arbitrary web script or HTML.