CVE-2014-125110
LOW 3.5 ALL-YEARSA vulnerability has been found in wp-file-upload Plugin up to 2.4.3 on WordPress and classified as problematic. Affected by this vulnerability is the function wfu_ajax_action_callback of the file lib/wfu_ajaxactions.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.4 is able to address this issue. The identifier of the patch is c846327df030a0a97da036a2f07c769ab9284ddb. It is recommended to upgrade the affected component. The identifier VDB-258781 was assigned to this vulnerability.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.6%chance of exploitation in 30 days · 47th percentile
Impact if exploited
3.5CVSS 3.1 · LOW · CNA
- ConfidentialityNone
- IntegrityLow
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Affected
Vendors —
Products Wp File Upload Plugin
Weakness (CWE)
- CWE-79: Cross Site Scripting
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
References and research data (JSON)
All CVSS metrics
- LOW 3.5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N - LOW 3.5 v3.0 · CNA Primary
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N - MEDIUM 4 v2.0 · CNA Primary
AV:N/AC:L/Au:S/C:N/I:P/A:N - LOW 3.5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N - MEDIUM 4 v2.0 · NVD Secondary
AV:N/AC:L/Au:S/C:N/I:P/A:N
References
Patches & mitigations
- https://github.com/wp-plugins/wp-file-upload/commit/c846327df030a0a97da036a2f07c769ab9284ddb CVE record · VulDB · Updated 2024-03-31T23:31:04.748Z
CVE record · CVE · Updated 2024-08-06T14:10:56.704Z
NVD · CVE-2014-125110 · Updated 2026-06-17T00:04:28.843 - https://github.com/wp-plugins/wp-file-upload/releases/tag/2.4.4 CVE record · VulDB · Updated 2024-03-31T23:31:04.748Z
CVE record · CVE · Updated 2024-08-06T14:10:56.704Z
NVD · CVE-2014-125110 · Updated 2026-06-17T00:04:28.843
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-1277 EUVD · EUVD-2014-1277
Technical & other
- https://vuldb.com/?id.258781 CVE record · VulDB · Updated 2024-03-31T23:31:04.748Z
CVE record · CVE · Updated 2024-08-06T14:10:56.704Z
NVD · CVE-2014-125110 · Updated 2026-06-17T00:04:28.843 - https://vuldb.com/?ctiid.258781 CVE record · VulDB · Updated 2024-03-31T23:31:04.748Z
CVE record · CVE · Updated 2024-08-06T14:10:56.704Z
NVD · CVE-2014-125110 · Updated 2026-06-17T00:04:28.843
Sources: NVD · CVE.org · All sources and attribution · EPSS