CVE-2014-4543 – Pay Per Media Player <= 1.24 - Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2014-4543

Multiple cross-site scripting (XSS) vulnerabilities in payper/payper.php in the Pay Per Media Player plugin 1.24 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) fcolor, (2) links, (3) stitle, (4) height, (5) width, (6) host, (7) bcolor, (8) msg, (9) id, or (10) size parameter. Múltiples vulnerabilidades de XSS en payper/payper.php en el plugin Pay Per Media Player 1.24 y anteriores para WordPress permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro (1) fcolor, (2) links, (3) stitle, (4) height, (5) width, (6) host, (7) bcolor, (8) msg, (9) id, o (10) size. • http://codevigilant.com/disclosure/wp-plugin-pay-per-media-player-a3-cross-site-scripting-xss http://www.securityfocus.com/bid/68447 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •