CVE-2016-4567 MediaElement Vulnerable to Reflected XSS

What is CVE-2016-4567?

CVE-2016-4567 is a medium-severity cross-site scripting vulnerability in Wordpress Wordpress, published on 22 May 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."

Weakness: CWE-79

Which versions are affected by CVE-2016-4567?

6 open source packages ship an affected version, including contao-components/mediaelement, contao/core and mediaelement. It affects 2 products.

Products include Mediaelementjs Mediaelement.js, Wordpress Wordpress.

How do I fix CVE-2016-4567?

Upgrade contao-components/mediaelement to 2.21.1 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2016-4567 being exploited?

There is no known exploitation of CVE-2016-4567 in the wild and no public exploit code.

Other vulnerabilities in Wordpress Wordpress

• CVE-2022-4699 MediaElement.js – HTML5 Video & Audio Player <= 4.2.8 - Contributor+ Stored XSS via Shortcode Medium 5.4
• CVE-2013-1967 Cross-site scripting in n/a Medium 4.3

All Wordpress Wordpress vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2016-4567, GHSA-277w-qpxr-2549, UBUNTU-CVE-2016-4567.