Unscored severity · published May 22, 2014
CVE-2014-3844
The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecified vectors
–
CVSS
1.8%
EPSS
No
On KEV
Description
The TinyMCE Color Picker plugin before 1.2 for WordPress does not properly check permissions, which allows remote attackers to modify plugin settings via unspecified vectors. NOTE: some of these details are obtained from third party information.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Color Picker · Tinymce
through 1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3844
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3844
secunia.com
http://secunia.com/advisories/58095
wordpress.org
http://wordpress.org/plugins/tinymce-colorpicker/changelog
More from Color Picker
–
CVE-2014-3845
Cross-site request forgery (CSRF) vulnerability in the TinyMCE Color Picker plugin before 1.2 for WordPress allows remote attackers to hijack the authentication of unspecified…