What risks are associated with the WordPress vulnerability CVE-2016-4567?

Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via the query string.

Can a simple comment on WordPress harm my system?

  • XSS doesn't usually harm your server, it harms your user's devices.
    – dandavis
    Commented Jun 1, 2016 at 0:41

1 Answer 1


It can, but not directly. This vulnerability does not inject code on your webserver, rather it injects JavaScript that, when you visit the page, will be executed in your browser. What can happen then is that an attacker steals your session cookies and logs onto your wordpress website or redirects you to a malicious page with malware or a phishing website to lure you into disclosing credentials.

  • 2
    The session cookies in WordPress are marked HTTP-only, so stealing that is out, but it doesn't prevent JavaScript from performing actions on the user's behalf. Commented Jun 1, 2016 at 0:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .