Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.

**WordPress 4.5.2** is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

See the [Release announcement](https://wordpress.org/news/2016/05/wordpress-4-5-2/)

----

Version 4.5.1 of WordPress is available and fixes 12 bugs. 

See [Release announcement](https://wordpress.org/news/2016/04/wordpress-4-5-1-maint enance-release/)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**WordPress 4.5.2** is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

See the [Release announcement](https://wordpress.org/news/2016/05/wordpress-4-5-2/)

---

**Packaging changes**

  - provide nginx configuration

  - drop mandatory dependency on httpd (only suggested) and     mod_php (php-fpm works)

  - protect php files in uploads directory

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of WordPress prior to 4.5.2 are affected by multiple vulnerabilities :

 - A flaw exists that is triggered when using the 'ephemeral' pseudo protocol, which may allow a context-dependent attacker to delete arbitrary files.
 - A flaw exists in the 'ms' pseudo protocol that is triggered when moving image files. This may allow a context-dependent attacker to move arbitrary files to arbitrary locations.
 - A flaw exists in the 'label' pseudo protocol that is triggered during the handling of a specially crafted image. This may allow a context-dependent attacker to read arbitrary files.
 - A flaw known as 'ImageTragick' is triggered as shell characters are not properly filtered in filenames passed to delegate commands. This may allow a context-dependent attacker to inject arbitrary shell commands and subsequently execute arbitrary code.
 - 'MediaElement.js' contains a flaw that allows a reflected cross-site scripting (XSS) attack. The program does not validate input before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - Plupload contains an unspecified same-origin method execution flaw. No further details have been provided.

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.5.2.
It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability, known as     ImageTragick, exists in the ImageMagick library due to a     failure to properly filter shell characters in filenames     passed to delegate commands. A remote attacker can     exploit this, via specially crafted images, to inject     shell commands and execute arbitrary code.
    (CVE-2016-3714)

  - An unspecified flaw exists in the ImageMagick library in     the 'ephemeral' pseudo protocol that allows an attacker     to delete arbitrary files. (CVE-2016-3715)

  - An unspecified flaw exists in the ImageMagick library in     the 'ms' pseudo protocol that allows an attacker to move     arbitrary files to arbitrary locations. (CVE-2016-3716)

  - An unspecified flaw exists in the ImageMagick library in     the 'label' pseudo protocol that allows an attacker, via     a specially crafted image, to read arbitrary files.
    (CVE-2016-3717)

  - A server-side request forgery (SSRF) vulnerability     exists due to an unspecified flaw related to request     handling between a user and the server. A remote     attacker can exploit this, via an MVG file with a     specially crafted fill element, to bypass access     restrictions and conduct host-based attacks.
    (CVE-2016-3718)

  - An unspecified flaw exists in Plupload that allows an     attacker to perform a same-origin method execution.
    (CVE-2016-4566)

  - A reflected cross-site scripting vulnerability exists in     MediaElement.js due to improper validation of     user-supplied input. A context-dependent attacker can     exploit this, via a specially crafted request, to     execute arbitrary script code in a user's browser     session. (CVE-2016-4567)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Helen Hou-Sandi reports :

WordPress 4.5.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.5.1 and earlier are affected by a SOME vulnerability through Plupload, the third-party library WordPress uses for uploading files. WordPress versions 4.2 through 4.5.1 are vulnerable to reflected XSS using specially crafted URIs through MediaElement.js, the third-party library used for media players.
MediaElement.js and Plupload have also released updates fixing these issues.

ID	Name	Product	Family	Severity
92193	Fedora 22 : wordpress (2016-e97a850183)	Nessus	Fedora Local Security Checks	medium
92180	Fedora 24 : wordpress (2016-d9bd0c4830)	Nessus	Fedora Local Security Checks	medium
92166	Fedora 23 : wordpress (2016-cf91320535)	Nessus	Fedora Local Security Checks	medium
9387	WordPress < 4.5.2 Multiple Vulnerabilities (ImageTragick)	Nessus Network Monitor	CGI	medium
91101	WordPress < 4.5.2 Multiple Vulnerabilities (ImageTragick)	Nessus	CGI abuses	high
91027	FreeBSD : wordpress -- multiple vulnerabilities (3686917b-164d-11e6-94fa-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-4566

medium

Tenable Plugins

medium

medium

medium

medium

high

medium