CVSS 3.0
6.1 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2016-4567
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
Severity
- EPSS
- 7.4% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mediaelementjs:mediaelement.js
- wordpress:wordpress
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-277w-qpxr-2549 | npm | mediaelement | <2.11.1 | 2.11.1 |
| GHSA-277w-qpxr-2549 | Packagist | contao-components/mediaelement | >=2.14.2 <2.21.1 | 2.21.1 |
| GHSA-277w-qpxr-2549 | Packagist | contao/core | >=3.0.0 <3.5.15 | 3.5.15 |