CVE-2016-4812

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the Markdown on Save Improved plugin before 2.5.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/en/jp/JVN26026353/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000071Vendor Advisory
https://srd.wordpress.org/plugins/markdown-on-save-improved/changelog/Vendor Advisory
http://jvn.jp/en/jp/JVN26026353/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000071Vendor Advisory
https://srd.wordpress.org/plugins/markdown-on-save-improved/changelog/Vendor Advisory

Timeline

Published: Jun 4, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-48138.8NetCommons 2.4.2.1 and earlier allows remote authenticated secretariat (aka CLERK) users to gain privileges by creating a SYSTEM_ADMIN accou CVE-2016-48147.5Directory traversal vulnerability in kml2jsonp.php in Geospatial Information Authority of Japan (aka GSI) Old_GSI_Maps before January 2015 o CVE-2016-48157.5Directory traversal vulnerability on BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices with firmware 2.16 a CVE-2016-48166.5BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow remote attackers to discover credentials and other CVE-2016-48177.5lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to caus CVE-2016-48185.9DMMFX Trade for Android 1.5.0 and earlier, DMMFX DEMO Trade for Android 1.5.0 and earlier, and GAITAMEJAPAN FX Trade for Android 1.4.0 and e CVE-2016-48199.8The printfDx function in Takumi Yamada DX Library for Borland C++ 3.13f through 3.16b, DX Library for Gnu C++ 3.13f through 3.16b, and DX Li CVE-2016-48208.8Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE ETX-R devices allows remote attackers to hijack the authentication of arb CVE-2016-48215.3I-O DATA DEVICE ETX-R devices allow remote attackers to cause a denial of service (web-server crash) via unspecified vectors.CVE-2016-48228.0Corega CG-WLBARGL devices allow remote authenticated users to execute arbitrary commands via unspecified vectors.CVE-2016-48237.5Corega CG-WLBARAGM devices allow remote attackers to cause a denial of service (reboot) via unspecified vectors.CVE-2016-48245.3The Wi-Fi Protected Setup (WPS) implementation on Corega CG-WLR300GNV and CG-WLR300GNV-W devices does not restrict the number of PIN authent