CVE-2014-5240

Published: Aug 18, 2014Modified: May 6, 2026

2.1

Vector

AV:N/AC:H/Au:S/C:N/I:P/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL.

Affected (33)

Products: Wordpress: Wordpress · Debian: Debian Linux

1 product

1 product

Configuration A

32 vulnerable

Vulnerable Software	Affected Versions
Wordpress Wordpress	Up to 3.9.1
Wordpress Wordpress	Version 3.0.1
Wordpress Wordpress	Version 3.0.2
Wordpress Wordpress	Version 3.0.3
Wordpress Wordpress	Version 3.0.4
Wordpress Wordpress	Version 3.0.5
Wordpress Wordpress	Version 3.0.6
Wordpress Wordpress	Version 3.0
Wordpress Wordpress	Version 3.1.1
Wordpress Wordpress	Version 3.1.2
Wordpress Wordpress	Version 3.1.3
Wordpress Wordpress	Version 3.1.4
Wordpress Wordpress	Version 3.1
Wordpress Wordpress	Version 3.2.1
Wordpress Wordpress	Version 3.2
Wordpress Wordpress	Version 3.2 beta1
Wordpress Wordpress	Version 3.3.1
Wordpress Wordpress	Version 3.3.2
Wordpress Wordpress	Version 3.3.3
Wordpress Wordpress	Version 3.3
Wordpress Wordpress	Version 3.4.0
Wordpress Wordpress	Version 3.4.1
Wordpress Wordpress	Version 3.4.2
Wordpress Wordpress	Version 3.5.0
Wordpress Wordpress	Version 3.5.1
Wordpress Wordpress	Version 3.6.1
Wordpress Wordpress	Version 3.6
Wordpress Wordpress	Version 3.7.1
Wordpress Wordpress	Version 3.7
Wordpress Wordpress	Version 3.8.1
Wordpress Wordpress	Version 3.8
Wordpress Wordpress	Version 3.9.0