XSS in WordPress Audio Player
Vulnerability: Cross-site scripting in WordPress Audio Player
Danger level: Low
Patch: Yes
Number of vulnerabilities: 1
CVE ID: CVE-2013-1464
Vector of operation: Remote
Impact: Cross Site Scripting
Affected products: WordPress Audio Player Plugin 2.x
Affected versions: WordPress Audio Player 2.0.4.5, possibly earlier.
Description:
The vulnerability allows malicious people to conduct XSS attacks.
The vulnerability is caused due to insufficient input validation in the parameter “playerID” in script wp-content/plugins/audio-player/assets/player.swf. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.
Manufacturer URL: http://wpaudioplayer.com/
Solution: Update to version 2.0.4.6 from the manufacturer.
Links:
http://wordpress.org/extend/plugins/audio-player/changelog/
http://packetstormsecurity.com/files/120129/WordPress-Audio-Player-SWF-Cross-Site-Scripting.html
