CVE-2016-4567: XSS
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
Other sources
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.swf in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
— GitHub
Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2 (see CVE-2013-1967)
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4567?
CVE-2016-4567 is classified as a medium severity cross-site scripting (XSS) vulnerability.
How do I fix CVE-2016-4567?
To fix CVE-2016-4567, upgrade MediaElement.js to version 2.21.0 or later and WordPress to version 4.5.2 or later.
Which versions of WordPress are affected by CVE-2016-4567?
CVE-2016-4567 affects WordPress versions prior to 4.5.2.
What components are vulnerable in CVE-2016-4567?
The vulnerable components in CVE-2016-4567 include MediaElement.js versions from 2.14.2 up to 2.21.1.
Can CVE-2016-4567 be exploited by remote attackers?
Yes, CVE-2016-4567 can be exploited by remote attackers to inject arbitrary web script or HTML.