Flash player widget <= 1.3 - Content Spoofing
Strategic Overview
Vulnerability Overview
The Flash player widget plugin for WordPress is vulnerable to Content Spoofing in versions up to, and including, 1.3. This is due to insufficient sanitization of user input on the 'mp3' parameter. This makes it possible for unauthenticated attackers to to inject arbitrary content in pages if they can successfully trick a user into performing an action such as clicking on a link.
Technical Analysis
REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-20 (Improper Input Validation) The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C