CVE-2014-4603 – Yahoo Updates For WordPress <= 1.0 - Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2014-4603

Multiple cross-site scripting (XSS) vulnerabilities in yupdates_application.php in the Yahoo! Updates for WordPress plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) secret, (2) key, or (3) appid parameter. Múltiples vulnerabilidades de XSS en yupdates_application.php en el plugin Yahoo! Updates for WordPress 1.0 y anteriores para WordPress permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro (1) secret, (2) key, o (3) appid. • http://codevigilant.com/disclosure/wp-plugin-yahoo-updates-for-wordpress-a3-cross-site-scripting-xss http://www.securityfocus.com/bid/68401 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •