CVE-2014-4664

EUVD-2014-4586
Cross-site scripting (XSS) vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to wp-admin/admin.php.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 70%
Affected Products (NVD)
VendorProductVersion
wordfence_security_projectwordfence_security
5.0.1
wordfence_security_projectwordfence_security
5.0.2
wordfence_security_projectwordfence_security
5.0.3
wordfence_security_projectwordfence_security
5.0.4
wordfence_security_projectwordfence_security
5.0.5
wordfence_security_projectwordfence_security
5.0.6
wordfence_security_projectwordfence_security
5.0.7
wordfence_security_projectwordfence_security
5.0.8
wordfence_security_projectwordfence_security
5.0.9
wordfence_security_projectwordfence_security
5.1.1
wordfence_security_projectwordfence_security
5.1.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://hacktivity.websecgeeks.com/word-press-firewall-plugin-xss/
http://www.securityfocus.com/archive/1/533907/100/0/threaded
http://www.securityfocus.com/bid/70911
http://www.securityfocus.com/bid/70915
http://www.wordfence.com/blog/2014/06/security-fix-wordfence-5-1-4/
https://wordpress.org/plugins/wordfence/changelog/
http://hacktivity.websecgeeks.com/word-press-firewall-plugin-xss/
http://www.securityfocus.com/archive/1/533907/100/0/threaded
http://www.securityfocus.com/bid/70911
http://www.securityfocus.com/bid/70915
http://www.wordfence.com/blog/2014/06/security-fix-wordfence-5-1-4/
https://wordpress.org/plugins/wordfence/changelog/