Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Versions of WordPress 3.7 prior to 3.7.5, 3.8.x prior to 3.8.5, 3.9.x prior to 3.9.3, and 4.x prior to 4.0.1 are susceptible to the following vulnerabilities : 

  - Three cross-site scripting issues that a contributor or author could use to compromise a site. (CVE-2014-9032, CVE-2014-9035, CVE-2014-9036)

  - A cross-site request forgery that could be used to trick a user into changing their password.(CVE-2014-9039)

  - An issue that could lead to a denial of service when passwords are checked. (CVE-2014-9034)

  - Additional protections for server-side request forgery attacks when WordPress makes HTTP requests. (CVE-2014-9033)

  - An extremely unlikely hash collision could allow a user's account to be compromised, that also required that they haven't logged in since 2008. (CVE-2014-9037)

  - WordPress now invalidates the links in a password reset email if the user remembers their password, logs in, and changes their email address. (CVE-2014-9039)

  - WordPress versions 3.9.2 and earlier are affected by a cross-site scripting vulnerability which could enable an anonymous user to compromise the site. (CVE-2014-9031)

WordPress 4.0.1 Security Release

See: https://wordpress.org/news/2014/11/wordpress-4-0-1/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated wordpress package fixes security vulnerabilities :

XSS in wptexturize() via comments or posts, exploitable for unauthenticated users (CVE-2014-9031).

XSS in media playlists (CVE-2014-9032).

CSRF in the password reset process (CVE-2014-9033).

Denial of service for giant passwords. The phpass library by Solar Designer was used in both projects without setting a maximum password length, which can lead to CPU exhaustion upon hashing (CVE-2014-9034).

XSS in Press This (CVE-2014-9035).

XSS in HTML filtering of CSS in posts (CVE-2014-9036).

Hash comparison vulnerability in old-style MD5-stored passwords (CVE-2014-9037).

SSRF: Safe HTTP requests did not sufficiently block the loopback IP address space (CVE-2014-9038).

Previously an email address change would not invalidate a previous password reset email (CVE-2014-9039).

According to its version number, the WordPress application installed on the remote web server is affected by multiple vulnerabilities :

  - Multiple unspecified errors exist that could allow     cross-site scripting attacks.

  - An unspecified error exists that could allow cross-site     request forgery attacks.

  - An error exists related to password handling that could     allow denial of service attacks.

  - An unspecified error exists that could allow server-side     request forgery attacks.

  - A hash collision error exists that could allow a user     account to be compromised.

  - An error exists related to password reset processing     that could allow a user account to be compromised.

  - An error exists related to the post or page comment     field that could allow persistent cross-site scripting     attacks.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
8584	WordPress 3.7 < 3.7.5 / 3.8 < 3.8.5 / 3.9 < 3.9.3 / 4.x < 4.0.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high
79774	Fedora 21 : wordpress-4.0.1-1.fc21 (2014-15560)	Nessus	Fedora Local Security Checks	medium
79678	Fedora 19 : wordpress-4.0.1-1.fc19 (2014-15526)	Nessus	Fedora Local Security Checks	medium
79674	Fedora 20 : wordpress-4.0.1-1.fc20 (2014-15507)	Nessus	Fedora Local Security Checks	medium
79613	Mandriva Linux Security Advisory : wordpress (MDVSA-2014:233)	Nessus	Mandriva Local Security Checks	medium
79437	WordPress < 3.7.5 / 3.8.5 / 3.9.3 / 4.0.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2014-9032

medium

Tenable Plugins

high

medium

medium

medium

medium

medium