Vulnerability
CVE-2016-9263
MEDIUM 4.7
CVE-2016-9263 is a medium-severity vulnerability (CVSS v3.0 4.7). As of 2026-10-20, 97 hosts in our data show software it affects on an open service in 11 countries.
WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.
- Published
- 2017-10-12
- Last modified
- 2026-06-17
- CVSS score
- 4.7 CVSS v3.0
- CVSS vector (v3.0)
- CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Exploit likelihood (EPSS)
- 2.2% in the next 30 days (top 18% of CVEs)
Exposure in our data
97 hosts
Hosts whose banner shows an affected software version on a service open at their latest check.
Not counted: 33 hosts with this CVE only from an older observation.
Counted 2026-10-20 04:20 UTC
By country
| Finland FI | 29 |
| Sweden SE | 28 |
| Lithuania LT | 26 |
| Estonia EE | 3 |
| Latvia LV | 3 |
| Germany DE | 2 |
| Norway NO | 2 |
| Czechia CZ | 1 |
| United Kingdom GB | 1 |
| Russia RU | 1 |
| Singapore SG | 1 |
Affected software seen
| wordpress 2.8 | 14 |
| wordpress 4.3.33 | 6 |
| wordpress 4.6.1 | 4 |
| wordpress 4.6.29 | 4 |
| wordpress 3.9.40 | 3 |
| wordpress 4.7.2 | 3 |
| wordpress 4.7.29 | 3 |
| wordpress 4.7.31 | 3 |
| wordpress 4.8.2 | 3 |
| wordpress 3.3.1 | 2 |
| wordpress 3.6.1 | 2 |
| wordpress 3.8.1 | 2 |