CVE-2014-4543

EUVD-2014-4470
Multiple cross-site scripting (XSS) vulnerabilities in payper/payper.php in the Pay Per Media Player plugin 1.24 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) fcolor, (2) links, (3) stitle, (4) height, (5) width, (6) host, (7) bcolor, (8) msg, (9) id, or (10) size parameter.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 38%
Affected Products (NVD)
VendorProductVersion
pay_per_media_player_projectpay_per_media_player
𝑥
≤ 1.24
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://codevigilant.com/disclosure/wp-plugin-pay-per-media-player-a3-cross-site-scripting-xss
http://www.securityfocus.com/bid/68447
http://codevigilant.com/disclosure/wp-plugin-pay-per-media-player-a3-cross-site-scripting-xss
http://www.securityfocus.com/bid/68447