Security Advisory

CVE-2014-5240

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2014-08-18 10:00:00

Last updated 2024-08-06 11:41:47

Assigner mitre

State PUBLISHED

Description

Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL.

← Browse all CVEs View on cve.org ↗