UpHeron
All vulnerabilities

WordPress core

CVE-2015-3439

Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.

Severity
Medium 4.3
Published
5 Aug 2015
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
WordPressWordPress core · cpe:a:wordpress:wordpress
  • Version 4.1.1
  • Version 4.1
  • Version 4.0.1
  • Version 4.0
All 8 release lines
  • Version 3.9.0
  • Version 3.9.1
  • Version 3.9.2
  • Version 3.9.3
  • Version 4.0
  • Version 4.0.1
  • Version 4.1
  • Version 4.1.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2015-3439
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2015-3439