CVE-2012-2401: Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, en...

Security readout for executives and security teams

This is an old browser-side upload component flaw. A vulnerable Plupload SWF could let a remote attacker bypass browser same-origin protections, potentially enabling cross-site scripting or cross-site request forgery in applications that embedded it. WordPress fixed its bundled copy in 3.3.2; other products may also have bundled vulnerable Plupload versions. Exposure is most likely in legacy web applications that still serve Plupload SWF uploader files, especially WordPress installations before 3.3.2 or other products bundling Plupload before 1.5.4. Modern sites that removed Flash/SWF uploaders are less likely exposed, but bundled copies can remain unnoticed. Prioritize this during legacy web application cleanup, especially for externally exposed WordPress or old CMS estates. It is not KEV-listed in the provided data, but it can undermine browser security boundaries where vulnerable SWF assets remain reachable. Mitigation focus: Upgrade Plupload to 1.5.4 or later where it is bundled directly.; Upgrade WordPress installations before 3.3.2 to a supported release.; Remove or disable obsolete Flash/SWF upload components if still served..

Prepared

Jun 24, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.