Unscored CVE-2014-4664 EUVD-2014-4586GHSA-8mph-qpr3-3458

Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbi…

Published Nov 6, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Description

Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to wp-admin/admin.php.

References

70911 vdb-entry
20141105 WordPress Wordfence Firewall 5.1.2 Cross Site Scripting mailing-list
http://www.wordfence.com/blog/2014/06/security-fix-wordfence-5-1-4/
http://hacktivity.websecgeeks.com/word-press-firewall-plugin-xss/
70915 vdb-entry
https://wordpress.org/plugins/wordfence/changelog/