CVE-2016-4567: Mediaelementjs Mediaelement.js

Medium severity, CVSS 6.1. EPSS: 7.4% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."

Affected products

• Mediaelementjs Mediaelement.js: up to and including 2.20.1
• WordPress WordPress: up to and including 4.5.1

Published 2016-05-22. Last modified 2026-06-17.