Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0,     as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an     obfuscated form of the jsinitfunction parameter, as demonstrated by jsinitfunctio%gn. (CVE-2016-4567)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0,
    as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an
    obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn." (CVE-2016-4567)

According to its self-reported version number, MediaElement.js is prior to 2.21.1. Therefore, it may be affected by a cross-site scripting vulnerability in flashmediaelement.swf.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of WordPress prior to 4.5.2 are affected by multiple vulnerabilities :

 - A flaw exists that is triggered when using the 'ephemeral' pseudo protocol, which may allow a context-dependent attacker to delete arbitrary files.
 - A flaw exists in the 'ms' pseudo protocol that is triggered when moving image files. This may allow a context-dependent attacker to move arbitrary files to arbitrary locations.
 - A flaw exists in the 'label' pseudo protocol that is triggered during the handling of a specially crafted image. This may allow a context-dependent attacker to read arbitrary files.
 - A flaw known as 'ImageTragick' is triggered as shell characters are not properly filtered in filenames passed to delegate commands. This may allow a context-dependent attacker to inject arbitrary shell commands and subsequently execute arbitrary code.
 - 'MediaElement.js' contains a flaw that allows a reflected cross-site scripting (XSS) attack. The program does not validate input before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - Plupload contains an unspecified same-origin method execution flaw. No further details have been provided.

According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.5.2.
It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability, known as     ImageTragick, exists in the ImageMagick library due to a     failure to properly filter shell characters in filenames     passed to delegate commands. A remote attacker can     exploit this, via specially crafted images, to inject     shell commands and execute arbitrary code.
    (CVE-2016-3714)

  - An unspecified flaw exists in the ImageMagick library in     the 'ephemeral' pseudo protocol that allows an attacker     to delete arbitrary files. (CVE-2016-3715)

  - An unspecified flaw exists in the ImageMagick library in     the 'ms' pseudo protocol that allows an attacker to move     arbitrary files to arbitrary locations. (CVE-2016-3716)

  - An unspecified flaw exists in the ImageMagick library in     the 'label' pseudo protocol that allows an attacker, via     a specially crafted image, to read arbitrary files.
    (CVE-2016-3717)

  - A server-side request forgery (SSRF) vulnerability     exists due to an unspecified flaw related to request     handling between a user and the server. A remote     attacker can exploit this, via an MVG file with a     specially crafted fill element, to bypass access     restrictions and conduct host-based attacks.
    (CVE-2016-3718)

  - An unspecified flaw exists in Plupload that allows an     attacker to perform a same-origin method execution.
    (CVE-2016-4566)

  - A reflected cross-site scripting vulnerability exists in     MediaElement.js due to improper validation of     user-supplied input. A context-dependent attacker can     exploit this, via a specially crafted request, to     execute arbitrary script code in a user's browser     session. (CVE-2016-4567)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Helen Hou-Sandi reports :

WordPress 4.5.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.5.1 and earlier are affected by a SOME vulnerability through Plupload, the third-party library WordPress uses for uploading files. WordPress versions 4.2 through 4.5.1 are vulnerable to reflected XSS using specially crafted URIs through MediaElement.js, the third-party library used for media players.
MediaElement.js and Plupload have also released updates fixing these issues.

ID	Name	Product	Family	Severity
254921	Linux Distros Unpatched Vulnerability : CVE-2016-4567	Nessus	Misc.	medium
432712	SCA: security update for contao-components/mediaelement, contao/core, mediaelement (GHSA-277w-qpxr-2549)	Tenable Cloud Security	SCA Checks	medium
432712	SCA: security update for contao-components/mediaelement, contao/core, mediaelement (GHSA-277w-qpxr-2549)	Tenable Self-Hosted Container Security	SCA Checks	medium
112556	MediaElement.js < 2.21.1 Cross-Site Scripting	Web App Scanning	Component Vulnerability	medium
9387	WordPress < 4.5.2 Multiple Vulnerabilities (ImageTragick)	Nessus Network Monitor	CGI	medium
91101	WordPress < 4.5.2 Multiple Vulnerabilities (ImageTragick)	Nessus	CGI abuses	high
91027	FreeBSD : wordpress -- multiple vulnerabilities (3686917b-164d-11e6-94fa-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-4567

medium

Tenable Plugins

medium

medium

medium

medium

medium

high

medium