Security readout for executives and security teams
Plain-English summary
CVE-2014-10392 is a cross-site scripting issue in the WordPress cforms2 plugin before version 10.2. Affected sites could allow attacker-controlled script to run in a visitor or administrator browser. The provided sources do not describe the attack path, required privileges, or business impact beyond XSS.
Executive priority
Handle as a targeted WordPress plugin hygiene item, not a confirmed emergency. Prioritize internet-facing sites, especially those used by administrators or customers, because XSS can support session theft, content tampering, or phishing when exploitable.
Technical view
The record identifies XSS in cforms2 for WordPress before 10.2. No CVSS score, CWE mapping, vulnerable parameter, authentication requirement, or stored-versus-reflected classification is provided in the source bundle. Treat exposure as version-based until vendor or WPVulnDB details confirm more.
Likely exposure
Exposure appears limited to WordPress installations running the cforms2 plugin earlier than 10.2. The supplied affected-product metadata is sparse, so confirm by checking installed plugin name, version, and whether the plugin is active.
Exploitation context
CISA KEV is false, and the provided sources do not state active exploitation. The bundle also does not provide exploit availability, attack complexity, or preconditions, so exploitation status should be considered unconfirmed.
Researcher notes
Evidence is thin. The sources identify cforms2 before 10.2 and XSS, but omit vector, affected endpoint, exploitability, authentication, and fix details beyond the version boundary. Further validation should rely on vendor history or controlled testing, not assumptions.
Mitigation direction
- Inventory WordPress sites for the cforms2 plugin and installed version.
- Update cforms2 to version 10.2 or later where available.
- Disable or remove cforms2 where it is not business-critical.
- Check the WordPress plugin page and vendor guidance for current maintenance status.
- Prioritize admin-facing WordPress sites and externally reachable forms first.
Validation and detection
- Confirm each WordPress instance has no cforms2 version earlier than 10.2.
- Verify inactive or removed plugin copies are not web-accessible.
- Review recent form and admin activity for suspicious browser-side behavior.
- Check whether compensating controls cover WordPress plugin XSS risks.
- Document any sites that cannot be upgraded and assign owners.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2014-10392 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wordpress.org/plugins/cforms2/#developersCVE reference · x_refsource_MISC
- https://wpvulndb.com/vulnerabilities/9621CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.