Unscored severity · published Mar 3, 2014
CVE-2014-2040
Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settings-api.php in the…
–
CVSS
1.6%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the (1) callback_multicheck, (2) callback_radio, and (3) callback_wysiwygin functions in mfrh_class.settings-api.php in the Media File Renamer plugin 1.7.0 for WordPress allow remote authenticated users with permissions to add media or edit media to inject arbitrary web script or HTML via unspecified parameters, as demonstrated by the title of an uploaded file.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MF
Media File Renamer · Jordy Meow
1.7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2040
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2040
www.securityfocus.com
http://www.securityfocus.com/archive/1/531270/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/65715
Exploit
http://www.vapid.dhs.org/advisories/wordpress/plugins/MediaFileRenamer-1.7.0/index.html