CVE-2013-2287: Multiple cross-site scripting (XSS) vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for Wo...

Security readout for executives and security teams

CVE-2013-2287 is a web injection issue in the Uploader plugin 1.0.4 for WordPress. A remote attacker could inject script or HTML through plugin parameters, potentially affecting visitors or administrators who load the vulnerable page. The source bundle does not provide a CVSS score, patch status, or evidence of active exploitation. Exposure appears limited to WordPress sites running the Uploader plugin version 1.0.4 with the vulnerable notify.php path reachable. The provided affected-product metadata is incomplete and lists no CPEs, so asset validation should rely on local plugin inventory rather than automated CPE matching alone. Moderate attention is reasonable if the plugin is present on public WordPress sites, especially administrative workflows. Urgency is lower without KEV or CVSS evidence, but unsupported vulnerable plugins should not remain exposed. Mitigation focus: Inventory WordPress sites for the Uploader plugin and exact version 1.0.4.; Check vendor or project guidance for fixed versions or removal advice.; Disable or remove the plugin where it is unused or unsupported..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.