CVE-2012-2401: Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was…

Unscored severity · published Apr 21, 2012

CVE-2012-2401

Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was…

–

CVSS

3.4%

EPSS

On KEV

Description

Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.

Exploitation

Is it being used?

Exploit prediction (EPSS)3.4% · higher than 89% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

WordPress · WordPress

through 3.3.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more · source: NVD

Plupload · Moxiecode

through 1.5.3; 1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.5.0; +3 more · source: NVD