Vulnerability-Lookup

CVE-2016-4567 (GCVE-0-2016-4567)

Vulnerability from cvelistv5 – Published: 2016-05-22 01:00 – Updated: 2024-08-06 00:32

Summary

Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."

Severity

6.1 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE

Assigner

mitre

References

9 references

URL	Tags
https://github.com/johndyer/mediaelement/blob/mas…	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/05/07/2	mailing-listx_refsource_MLIST
https://codex.wordpress.org/Version_4.5.2	x_refsource_CONFIRM
http://www.securitytracker.com/id/1035818	vdb-entryx_refsource_SECTRACK
https://gist.github.com/cure53/df34ea68c26441f3ae…	x_refsource_MISC
https://github.com/johndyer/mediaelement/commit/3…	x_refsource_CONFIRM
https://wpvulndb.com/vulnerabilities/8488	x_refsource_MISC
https://wordpress.org/news/2016/05/wordpress-4-5-2/	x_refsource_CONFIRM
https://core.trac.wordpress.org/changeset/37371	x_refsource_CONFIRM

Date Public

2016-05-07 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T00:32:26.013Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/johndyer/mediaelement/blob/master/changelog.md"
          },
          {
            "name": "[oss-security] 20160507 CVE Request: wordpress and mediaelement",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/05/07/2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://codex.wordpress.org/Version_4.5.2"
          },
          {
            "name": "1035818",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1035818"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wpvulndb.com/vulnerabilities/8488"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://wordpress.org/news/2016/05/wordpress-4-5-2/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://core.trac.wordpress.org/changeset/37371"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-05-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by \"jsinitfunctio%gn.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-29T16:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/johndyer/mediaelement/blob/master/changelog.md"
        },
        {
          "name": "[oss-security] 20160507 CVE Request: wordpress and mediaelement",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/05/07/2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://codex.wordpress.org/Version_4.5.2"
        },
        {
          "name": "1035818",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1035818"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wpvulndb.com/vulnerabilities/8488"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://wordpress.org/news/2016/05/wordpress-4-5-2/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://core.trac.wordpress.org/changeset/37371"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-4567",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by \"jsinitfunctio%gn.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/johndyer/mediaelement/blob/master/changelog.md",
              "refsource": "CONFIRM",
              "url": "https://github.com/johndyer/mediaelement/blob/master/changelog.md"
            },
            {
              "name": "[oss-security] 20160507 CVE Request: wordpress and mediaelement",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/05/07/2"
            },
            {
              "name": "https://codex.wordpress.org/Version_4.5.2",
              "refsource": "CONFIRM",
              "url": "https://codex.wordpress.org/Version_4.5.2"
            },
            {
              "name": "1035818",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1035818"
            },
            {
              "name": "https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c",
              "refsource": "MISC",
              "url": "https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c"
            },
            {
              "name": "https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e",
              "refsource": "CONFIRM",
              "url": "https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e"
            },
            {
              "name": "https://wpvulndb.com/vulnerabilities/8488",
              "refsource": "MISC",
              "url": "https://wpvulndb.com/vulnerabilities/8488"
            },
            {
              "name": "https://wordpress.org/news/2016/05/wordpress-4-5-2/",
              "refsource": "CONFIRM",
              "url": "https://wordpress.org/news/2016/05/wordpress-4-5-2/"
            },
            {
              "name": "https://core.trac.wordpress.org/changeset/37371",
              "refsource": "CONFIRM",
              "url": "https://core.trac.wordpress.org/changeset/37371"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-4567",
    "datePublished": "2016-05-22T01:00:00.000Z",
    "dateReserved": "2016-05-07T00:00:00.000Z",
    "dateUpdated": "2024-08-06T00:32:26.013Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2016-4567",
      "date": "2026-07-17",
      "epss": "0.06405",
      "percentile": "0.929"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mediaelementjs:mediaelement.js:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"2.20.1\", \"matchCriteriaId\": \"7C1F3E4B-3818-4C0E-9BFA-B2183A8CE8D5\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"4.5.1\", \"matchCriteriaId\": \"DE5AB579-3BD2-49C4-9260-E8FB37637360\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by \\\"jsinitfunctio%gn.\\\"\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de XSS en flash/FlashMediaElement.as en MediaElement.js en versiones anteriores a 2.21.0, como se utiliza en WordPress en versiones anteriores a 4.5.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\\u00e9s de un formulario ofuscado del par\\u00e1metro jsinitfunction, como es demostrado por \\\"jsinitfunctio%gn\\\".\"}]",
      "id": "CVE-2016-4567",
      "lastModified": "2024-11-21T02:52:30.360",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2016-05-22T01:59:31.230",
      "references": "[{\"url\": \"http://www.openwall.com/lists/oss-security/2016/05/07/2\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securitytracker.com/id/1035818\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://codex.wordpress.org/Version_4.5.2\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://core.trac.wordpress.org/changeset/37371\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\"]}, {\"url\": \"https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/johndyer/mediaelement/blob/master/changelog.md\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://wordpress.org/news/2016/05/wordpress-4-5-2/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://wpvulndb.com/vulnerabilities/8488\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2016/05/07/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securitytracker.com/id/1035818\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://codex.wordpress.org/Version_4.5.2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://core.trac.wordpress.org/changeset/37371\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/johndyer/mediaelement/blob/master/changelog.md\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://wordpress.org/news/2016/05/wordpress-4-5-2/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://wpvulndb.com/vulnerabilities/8488\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2016-4567\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2016-05-22T01:59:31.230\",\"lastModified\":\"2026-05-06T22:30:45.220\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by \\\"jsinitfunctio%gn.\\\"\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de XSS en flash/FlashMediaElement.as en MediaElement.js en versiones anteriores a 2.21.0, como se utiliza en WordPress en versiones anteriores a 4.5.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un formulario ofuscado del par\u00e1metro jsinitfunction, como es demostrado por \\\"jsinitfunctio%gn\\\".\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mediaelementjs:mediaelement.js:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.20.1\",\"matchCriteriaId\":\"7C1F3E4B-3818-4C0E-9BFA-B2183A8CE8D5\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"4.5.1\",\"matchCriteriaId\":\"DE5AB579-3BD2-49C4-9260-E8FB37637360\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2016/05/07/2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id/1035818\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://codex.wordpress.org/Version_4.5.2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://core.trac.wordpress.org/changeset/37371\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/johndyer/mediaelement/blob/master/changelog.md\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://wordpress.org/news/2016/05/wordpress-4-5-2/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://wpvulndb.com/vulnerabilities/8488\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/05/07/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1035818\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://codex.wordpress.org/Version_4.5.2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://core.trac.wordpress.org/changeset/37371\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/johndyer/mediaelement/blob/master/changelog.md\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://wordpress.org/news/2016/05/wordpress-4-5-2/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://wpvulndb.com/vulnerabilities/8488\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-11-21T12:03:11+00:00",
      "cve": "CVE-2016-4567",
      "id": "CVE-2016-4567",
      "initial_release_date": "2016-05-07T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "wordpress: 4.5.2 Security Release",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2016/cve-2016-4567.json",
      "version": "3"
    }
  }
}

CNVD-2016-02897

Vulnerability from cnvd - Published: 2016-05-10

Title

WordPress 'MediaElement.js'跨站脚本漏洞

Description

WordPress是WordPress软件基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 WordPress 4.2版本至4.5.1版本的MediaElement.js文件中存在跨站脚本漏洞。攻击者可借助特制的URI利用该漏洞注入任意Web脚本或HTML。

Severity

中

Patch Name

WordPress 'MediaElement.js'跨站脚本漏洞的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://wordpress.org/news/2016/05/wordpress-4-5-2/

Reference

http://www.openwall.com/lists/oss-security/2016/05/07/7

Impacted products

Name
WordPress WordPress >=4.2，<=4.5.1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-4567"
    }
  },
  "description": "WordPress\u662fWordPress\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u4f7f\u7528PHP\u8bed\u8a00\u5f00\u53d1\u7684\u535a\u5ba2\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u652f\u6301\u5728PHP\u548cMySQL\u7684\u670d\u52a1\u5668\u4e0a\u67b6\u8bbe\u4e2a\u4eba\u535a\u5ba2\u7f51\u7ad9\u3002\r\n\r\nWordPress 4.2\u7248\u672c\u81f34.5.1\u7248\u672c\u7684MediaElement.js\u6587\u4ef6\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684URI\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u4efb\u610fWeb\u811a\u672c\u6216HTML\u3002",
  "discovererName": "CVE Assignment Team",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://wordpress.org/news/2016/05/wordpress-4-5-2/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-02897",
  "openTime": "2016-05-10",
  "patchDescription": "WordPress\u662fWordPress\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u4e00\u5957\u4f7f\u7528PHP\u8bed\u8a00\u5f00\u53d1\u7684\u535a\u5ba2\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u652f\u6301\u5728PHP\u548cMySQL\u7684\u670d\u52a1\u5668\u4e0a\u67b6\u8bbe\u4e2a\u4eba\u535a\u5ba2\u7f51\u7ad9\u3002\r\n\r\nWordPress 4.2\u7248\u672c\u81f34.5.1\u7248\u672c\u7684MediaElement.js\u6587\u4ef6\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684URI\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u4efb\u610fWeb\u811a\u672c\u6216HTML\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "WordPress \u0027MediaElement.js\u0027\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "WordPress WordPress \u003e=4.2\uff0c\u003c=4.5.1"
  },
  "referenceLink": "http://www.openwall.com/lists/oss-security/2016/05/07/7",
  "serverity": "\u4e2d",
  "submitTime": "2016-05-09",
  "title": "WordPress \u0027MediaElement.js\u0027\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}

FKIE_CVE-2016-4567

Vulnerability from fkie_nvd - Published: 2016-05-22 01:59 - Updated: 2026-06-17 00:47

Severity

6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
cve@mitre.org	http://www.openwall.com/lists/oss-security/2016/05/07/2
cve@mitre.org	http://www.securitytracker.com/id/1035818	Third Party Advisory, VDB Entry
cve@mitre.org	https://codex.wordpress.org/Version_4.5.2	Patch, Vendor Advisory
cve@mitre.org	https://core.trac.wordpress.org/changeset/37371	Patch
cve@mitre.org	https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c	Third Party Advisory
cve@mitre.org	https://github.com/johndyer/mediaelement/blob/master/changelog.md	Patch, Vendor Advisory
cve@mitre.org	https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e	Patch, Vendor Advisory
cve@mitre.org	https://wordpress.org/news/2016/05/wordpress-4-5-2/	Patch, Vendor Advisory
cve@mitre.org	https://wpvulndb.com/vulnerabilities/8488	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2016/05/07/2
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id/1035818	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://codex.wordpress.org/Version_4.5.2	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://core.trac.wordpress.org/changeset/37371	Patch
af854a3a-2127-422b-91ae-364da2661108	https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/johndyer/mediaelement/blob/master/changelog.md	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://wordpress.org/news/2016/05/wordpress-4-5-2/	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://wpvulndb.com/vulnerabilities/8488	Third Party Advisory

Impacted products

	Vendor	Product	Version
	mediaelementjs	mediaelement.js	*
	wordpress	wordpress	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mediaelementjs:mediaelement.js:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7C1F3E4B-3818-4C0E-9BFA-B2183A8CE8D5",
              "versionEndIncluding": "2.20.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE5AB579-3BD2-49C4-9260-E8FB37637360",
              "versionEndIncluding": "4.5.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by \"jsinitfunctio%gn.\""
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en flash/FlashMediaElement.as en MediaElement.js en versiones anteriores a 2.21.0, como se utiliza en WordPress en versiones anteriores a 4.5.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un formulario ofuscado del par\u00e1metro jsinitfunction, como es demostrado por \"jsinitfunctio%gn\"."
    }
  ],
  "id": "CVE-2016-4567",
  "lastModified": "2026-06-17T00:47:48.070",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-05-22T01:59:31.230",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://www.openwall.com/lists/oss-security/2016/05/07/2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1035818"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://codex.wordpress.org/Version_4.5.2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://core.trac.wordpress.org/changeset/37371"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/johndyer/mediaelement/blob/master/changelog.md"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://wordpress.org/news/2016/05/wordpress-4-5-2/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://wpvulndb.com/vulnerabilities/8488"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2016/05/07/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1035818"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://codex.wordpress.org/Version_4.5.2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://core.trac.wordpress.org/changeset/37371"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/johndyer/mediaelement/blob/master/changelog.md"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://wordpress.org/news/2016/05/wordpress-4-5-2/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://wpvulndb.com/vulnerabilities/8488"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-277W-QPXR-2549

Vulnerability from github – Published: 2022-05-17 03:35 – Updated: 2024-04-25 21:38

Summary

MediaElement Vulnerable to Reflected XSS

Details

Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.swf in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."

Severity

6.1 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mediaelement"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "contao-components/mediaelement"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.14.2"
            },
            {
              "fixed": "2.21.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "contao/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.5.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-4567"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-25T21:38:55Z",
    "nvd_published_at": "2016-05-22T01:59:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.swf in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by \"jsinitfunctio%gn.\"",
  "id": "GHSA-277w-qpxr-2549",
  "modified": "2024-04-25T21:38:55Z",
  "published": "2022-05-17T03:35:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4567"
    },
    {
      "type": "WEB",
      "url": "https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mediaelement/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e"
    },
    {
      "type": "WEB",
      "url": "https://codex.wordpress.org/Version_4.5.2"
    },
    {
      "type": "WEB",
      "url": "https://contao.org/en/news/contao-3_5_15.html"
    },
    {
      "type": "WEB",
      "url": "https://core.trac.wordpress.org/changeset/37371"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/contao-components/mediaelement/CVE-2016-4567.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2016-4567.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/johndyer/mediaelement/blob/master/changelog.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mediaelement/mediaelement/blob/b992ccf5f0c04a207d98bbb0868420751a61ec90/changelog.md?plain=1#L1024"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mediaelement/mediaelement/blob/master/changelog.md"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20170205142412/http://www.securitytracker.com/id/1035818"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/news/2016/05/wordpress-4-5-2"
    },
    {
      "type": "WEB",
      "url": "https://wpvulndb.com/vulnerabilities/8488"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/05/07/2"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1035818"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MediaElement Vulnerable to Reflected XSS "
}

GSD-2016-4567

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2016-4567

Aliases

CVE-2016-4567

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2016-4567",
    "description": "Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by \"jsinitfunctio%gn.\"",
    "id": "GSD-2016-4567"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2016-4567"
      ],
      "details": "Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by \"jsinitfunctio%gn.\"",
      "id": "GSD-2016-4567",
      "modified": "2023-12-13T01:21:19.176411Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2016-4567",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by \"jsinitfunctio%gn.\""
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/johndyer/mediaelement/blob/master/changelog.md",
            "refsource": "CONFIRM",
            "url": "https://github.com/johndyer/mediaelement/blob/master/changelog.md"
          },
          {
            "name": "[oss-security] 20160507 CVE Request: wordpress and mediaelement",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2016/05/07/2"
          },
          {
            "name": "https://codex.wordpress.org/Version_4.5.2",
            "refsource": "CONFIRM",
            "url": "https://codex.wordpress.org/Version_4.5.2"
          },
          {
            "name": "1035818",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id/1035818"
          },
          {
            "name": "https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c",
            "refsource": "MISC",
            "url": "https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c"
          },
          {
            "name": "https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e",
            "refsource": "CONFIRM",
            "url": "https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e"
          },
          {
            "name": "https://wpvulndb.com/vulnerabilities/8488",
            "refsource": "MISC",
            "url": "https://wpvulndb.com/vulnerabilities/8488"
          },
          {
            "name": "https://wordpress.org/news/2016/05/wordpress-4-5-2/",
            "refsource": "CONFIRM",
            "url": "https://wordpress.org/news/2016/05/wordpress-4-5-2/"
          },
          {
            "name": "https://core.trac.wordpress.org/changeset/37371",
            "refsource": "CONFIRM",
            "url": "https://core.trac.wordpress.org/changeset/37371"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=2.14.2,\u003c2.21.1",
          "affected_versions": "All versions starting from 2.14.2 before 2.21.1",
          "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2016-12-02",
          "description": "A security vulnerability in the software `mediaelement.js` allows to execute arbitrary Javascript code.",
          "fixed_versions": [
            "2.21.1"
          ],
          "identifier": "CVE-2016-4567",
          "identifiers": [
            "CVE-2016-4567"
          ],
          "not_impacted": "All versions before 2.14.2, all versions starting from 2.21.1",
          "package_slug": "packagist/contao-components/mediaelement",
          "pubdate": "2016-05-21",
          "solution": "Upgrade to version 2.21.1 or above.",
          "title": "XSS security vulnerability",
          "urls": [
            "https://contao.org/en/news/contao-3_5_15.html"
          ],
          "uuid": "50d20104-6011-4d8c-9bd6-2626a63edd7c"
        },
        {
          "affected_range": "\u003e=3.0.0,\u003c3.5.15",
          "affected_versions": "All versions starting from 3.0.0 before 3.5.15",
          "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2016-12-02",
          "description": "Cross-site scripting (XSS) vulnerability in `flash/FlashMediaElement.as` in `MediaElement.js` allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the `jsinitfunction` parameter, as demonstrated by `jsinitfunctio%gn`.\"",
          "fixed_versions": [
            "3.5.15"
          ],
          "identifier": "CVE-2016-4567",
          "identifiers": [
            "CVE-2016-4567"
          ],
          "not_impacted": "All versions before 3.0.0, all versions starting from 3.5.15",
          "package_slug": "packagist/contao/core",
          "pubdate": "2016-05-21",
          "solution": "Upgrade to version 3.5.15 or above.",
          "title": "Cross-site Scripting",
          "urls": [
            "https://contao.org/en/news/contao-3_5_15.html"
          ],
          "uuid": "c976cf62-8d88-4cb6-8955-90e0a4d4351f"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mediaelementjs:mediaelement.js:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2.20.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.5.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-4567"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by \"jsinitfunctio%gn.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wordpress.org/news/2016/05/wordpress-4-5-2/",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://wordpress.org/news/2016/05/wordpress-4-5-2/"
            },
            {
              "name": "[oss-security] 20160507 CVE Request: wordpress and mediaelement",
              "refsource": "MLIST",
              "tags": [],
              "url": "http://www.openwall.com/lists/oss-security/2016/05/07/2"
            },
            {
              "name": "https://codex.wordpress.org/Version_4.5.2",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://codex.wordpress.org/Version_4.5.2"
            },
            {
              "name": "https://core.trac.wordpress.org/changeset/37371",
              "refsource": "CONFIRM",
              "tags": [
                "Patch"
              ],
              "url": "https://core.trac.wordpress.org/changeset/37371"
            },
            {
              "name": "https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e"
            },
            {
              "name": "https://github.com/johndyer/mediaelement/blob/master/changelog.md",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://github.com/johndyer/mediaelement/blob/master/changelog.md"
            },
            {
              "name": "https://wpvulndb.com/vulnerabilities/8488",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://wpvulndb.com/vulnerabilities/8488"
            },
            {
              "name": "https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c"
            },
            {
              "name": "1035818",
              "refsource": "SECTRACK",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securitytracker.com/id/1035818"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2016-12-02T23:01Z",
      "publishedDate": "2016-05-22T01:59Z"
    }
  }
}

ubuntu-cve-2016-4567

Vulnerability from osv_ubuntu

Published

2016-05-22 01:59

Modified

2026-05-20 14:49

Summary

Details

Severity

6.1 (Medium)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-4567	REPORT
	https://core.trac.wordpress.org/changeset/37370	REPORT
	http://www.openwall.com/lists/oss-security/2016/05/07/2	REPORT
	https://www.cve.org/CVERecord?id=CVE-2016-4567	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-mediaelement",
            "binary_version": "2.15.1+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "mediaelement",
        "purl": "pkg:deb/ubuntu/mediaelement@2.15.1+dfsg-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.15.1+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-mediaelement",
            "binary_version": "2.15.1+dfsg-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "mediaelement",
        "purl": "pkg:deb/ubuntu/mediaelement@2.15.1+dfsg-1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.15.1+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-mediaelement",
            "binary_version": "2.15.1+dfsg-1ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "mediaelement",
        "purl": "pkg:deb/ubuntu/mediaelement@2.15.1+dfsg-1ubuntu1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.15.1+dfsg-1",
        "2.15.1+dfsg-1ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-mediaelement",
            "binary_version": "2.15.1+dfsg-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "mediaelement",
        "purl": "pkg:deb/ubuntu/mediaelement@2.15.1+dfsg-3?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.15.1+dfsg-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-mediaelement",
            "binary_version": "2.15.1+dfsg-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "mediaelement",
        "purl": "pkg:deb/ubuntu/mediaelement@2.15.1+dfsg-3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.15.1+dfsg-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-mediaelement",
            "binary_version": "2.15.1+dfsg-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "mediaelement",
        "purl": "pkg:deb/ubuntu/mediaelement@2.15.1+dfsg-3?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.15.1+dfsg-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjs-mediaelement",
            "binary_version": "2.15.1+dfsg-3build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "mediaelement",
        "purl": "pkg:deb/ubuntu/mediaelement@2.15.1+dfsg-3build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.15.1+dfsg-3",
        "2.15.1+dfsg-3build1"
      ]
    }
  ],
  "aliases": [],
  "details": "Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by \"jsinitfunctio%gn.\"",
  "id": "UBUNTU-CVE-2016-4567",
  "modified": "2026-05-20T14:49:20Z",
  "published": "2016-05-22T01:59:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-4567"
    },
    {
      "type": "REPORT",
      "url": "https://core.trac.wordpress.org/changeset/37370"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2016/05/07/2"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-4567"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-4567"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2016-4567 (GCVE-0-2016-4567)

CNVD-2016-02897

FKIE_CVE-2016-4567

GHSA-277W-QPXR-2549

GSD-2016-4567

ubuntu-cve-2016-4567

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature