Description
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.swf in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by “jsinitfunctio%gn.
Recommendation
Update the mediaelement package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.11.1
- Patched version(s): 2.11.1
References
Could your website be exposed too?
SmartScanner can check your website for MediaElement Vulnerable to Reflected XSS and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Formstone Vulnerable to Reflected XSS - CVE-2020-26768
- bracket-template vulnerable to reflected XSS - CVE-2018-3735
- Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
- Webrecorder packages are vulnerable to XSS through 404 error handling logic - CVE-2025-58765
You might also like:
See something that needs correcting? Let us knowUpdated April 25, 2024