CVE-2009-4168
Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus...
CVE-2009-4168 is a medium vulnerability (CVSS 4.3) in Roytanck Wp-cumulus, published December 2, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.47%, the 92nd percentile. No source names a fixed version.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 5.47%EPSS, 92nd percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Plugin WP-Cumulus 1.x - 'tagcloud.swf' Cross-Site Scripting | 2009-11-09 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.
- Record
CVE-2009-4168- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.
- Record
CVE-2009-4168- Updated
- 2026-11-02
EUVDEUVD-2009-4138No score
Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.
- Record
EUVD-2009-4138- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f865-32w6-7639No score
Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus...
Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.
- Record
GHSA-f865-32w6-7639- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/archive/1/508606/100/0/threaded
packetstormsecurity.org/1001-exploits/joomlajvclouds-xss.txt
websecurity.com.ua/3789
exchange.xforce.ibmcloud.com/vulnerabilities/55156
Show 12 moreShow less
secunia.com/advisories/37483
roytanck.com/2009/11/15/wp-cumulus-updated-to-address-yet-another-security-issue
vupen.com/english/advisories/2009/3322
nvd.nist.gov/vuln/detail/CVE-2009-4168
github.com/advisories/GHSA-f865-32w6-7639