CVE-2012-2401
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other...
CVE-2012-2401 is a medium vulnerability (CVSS 5.0) in Moxiecode Plupload, published April 21, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.50%, the 89th percentile. Fixed in wordpress 3.3.2+dfsg-1.
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
Exploit likelihood
What each source reports
NVD Score used
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
- Record
CVE-2012-2401- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
- Record
CVE-2012-2401- Updated
- 2026-11-02
EUVDEUVD-2012-2388 No score
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
- Record
EUVD-2012-2388- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ch8h-4j2v-gwvg No score
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other...
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
- Record
GHSA-ch8h-4j2v-gwvg- Updated
- 2026-11-02
OSV No score
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
- Record
CVE-2012-2401- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-2401 No score
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
- Record
DEBIAN-CVE-2012-2401- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wordpressDebian:12 |
before 3.3.2+dfsg-1 | 3.3.2+dfsg-1 |
wordpressDebian:13 |
before 3.3.2+dfsg-1 | 3.3.2+dfsg-1 |
wordpressDebian:14 |
before 3.3.2+dfsg-1 | 3.3.2+dfsg-1 |
wordpressDebian:6.0 |
before 3.3.2+dfsg-1~squeeze1, plus listed versions 3.0.4+dfsg-13.0.5+dfsg-0+squeeze13.0.5+dfsg-13.2.1+dfsg-13.2.1+dfsg-23.2.1+dfsg-33.3+dfsg-13.3.1+dfsg-1 |
3.3.2+dfsg-1~squeeze1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
osvdb.org/81461
secunia.com/advisories/49138
plupload.com/punbb/viewtopic.php?id=1685
core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload?rev=20487
exchange.xforce.ibmcloud.com/vulnerabilities/75208
debian.org/security/2012/dsa-2470
Show 7 moreShow less
nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload
securityfocus.com/bid/53192
wordpress.org/news/2012/04/wordpress-3-3-2
nvd.nist.gov/vuln/detail/CVE-2012-2401
github.com/advisories/GHSA-ch8h-4j2v-gwvg
security-tracker.debian.org/tracker/CVE-2012-2401