CVE-2009-4168: Roytanck Wp-Cumulus

Medium severity, CVSS 4.3. EPSS: 5.5% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.

Affected products

• Roytanck Wp-Cumulus: up to and including 1.22; version 1.00 only; version 1.01 only; version 1.02 only; version 1.2.1 only; version 1.03 only; …

Published 2009-12-02. Last modified 2026-06-16.