# CVEs published 2012-04-21

6 CVEs were published on April 21, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2012-2399](https://cve.now/CVE-2012-2399.md): Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image (no CVSS)
- [CVE-2012-2400](https://cve.now/CVE-2012-2400.md): Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors. (no CVSS)
- [CVE-2012-2401](https://cve.now/CVE-2012-2401.md): Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the (no CVSS)
- [CVE-2012-2402](https://cve.now/CVE-2012-2402.md): wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and de (no CVSS)
- [CVE-2012-2403](https://cve.now/CVE-2012-2403.md): wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote (no CVSS)
- [CVE-2012-2404](https://cve.now/CVE-2012-2404.md): wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-04-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.