CVE-2013-0237

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-07-08 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.

Affected products

Fedoraproject Fedora: 16, 17, 18
Moxiecode Plupload: through 1.5.4; 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.5.0, 1.5.0-beta (+3)
WordPress: through 3.5.0; 0.71, 1.0, 1.0.1, 1.0.2, 1.1.1, 1.2 (+69)

References

http://codex.wordpress.org/Version_3.5.1
http://wordpress.org/news/2013/01/wordpress-3-5-1/
https://bugzilla.redhat.com/show_bug.cgi?id=904122
https://github.com/moxiecode/plupload/commit/2d746ee9083c184f1234d8fed311e89bdd1b39e5
http://codex.wordpress.org/Version_3.5.1
http://wordpress.org/news/2013/01/wordpress-3-5-1/
https://bugzilla.redhat.com/show_bug.cgi?id=904122
https://github.com/moxiecode/plupload/commit/2d746ee9083c184f1234d8fed311e89bdd1b39e5

Get alerted when CVE-2013-0237 or the next vulnerability affects your stack