CVE-2009-4168

no score yetEPSS 5.5%

Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.

EPSS: 5.5% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2009-12-02
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

roytanck:wp-cumulus

References

http://packetstormsecurity.org/1001-exploits/joomlajvclouds-xss.txt
http://secunia.com/advisories/37483
http://secunia.com/advisories/38161
http://websecurity.com.ua/3665/
http://websecurity.com.ua/3789/

Check your stack JSON