UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2014-4932

Wordfence Security – Firewall, Malware Scan, and Login Security: Cross-site Scripting

Severity
Medium 6.1
Published
8 Dec 2014
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
5.1.5
Also known as
WPV-3c9b64a2808e
Sources
NVD, WPVulnerability

Description

Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the val parameter to whois.php.

Affected software

SoftwareAffected versions
Wordfence SecurityServers and applications · cpe:a:wordfence:wordfence_security
  • Every version before 5.1.5
Wordfence SecurityWordPress plugins · wp-plugin:wordfence
  • Every version before 5.1.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2014-4932
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2014-4932
  • Wordfence https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wordfence/wordfence-514-reflected-cross-site-scripting