Unrated severityNVD Advisory· Published Jul 22, 2012· Updated Jun 16, 2026

CVE-2012-3383

Description

The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks by leveraging the Administrator or Editor role and composing crafted text.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/WordPress2 versions
cpe:2.3:a:wordpress:wordpress:3.4.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:wordpress:wordpress:3.4.0:*:*:*:*:*:*:*
- (no CPE)range: >=3.4.0, <3.4.2
Package: https://wordpress.org/plugins/wordpress

Patches

Vulnerability mechanics

References

codex.wordpress.org/Version_3.4.1nvd
codex.wordpress.org/Version_3.4.2nvd
core.trac.wordpress.org/changesetnvd
core.trac.wordpress.org/changesetnvd
openwall.com/lists/oss-security/2012/09/12/17nvd
www.openwall.com/lists/oss-security/2012/07/02/1nvd
www.openwall.com/lists/oss-security/2012/07/08/1nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000