CVE-2014-4588

Name of the Vulnerable Software and Affected Versions wphotfiles plugin versions 1.0.0 and earlier

Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the mediaid parameter in the tpls/editmedia.php file.

Recommendations For wphotfiles plugin versions 1.0.0 and earlier, avoid using the mediaid parameter in the tpls/editmedia.php file until a fix is available. Consider temporarily restricting access to the tpls/editmedia.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.