{"api_version":"1","generated_at":"2026-07-23T08:25:49+00:00","cve":"CVE-2014-5196","urls":{"html":"https://cve.report/CVE-2014-5196","api":"https://cve.report/api/cve/CVE-2014-5196.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-5196","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-5196"},"summary":{"title":"CVE-2014-5196","description":"Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the iusib_meta_fields parameter.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-08-12 20:55:03","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://security.dxw.com/advisories/csrf-and-xss-in-improved-user-search-allow-execution-of-arbitrary-javascript-in-wordpress-admin-area/","name":"https://security.dxw.com/advisories/csrf-and-xss-in-improved-user-search-allow-execution-of-arbitrary-javascript-in-wordpress-admin-area/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"CSRF and XSS in Improved user search allow execution of arbitrary javascript in WordPress admin area | dxwsecurity","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://wordpress.org/plugins/improved-user-search-in-backend/changelog","name":"http://wordpress.org/plugins/improved-user-search-in-backend/changelog","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"WordPress › Improved user search in backend « WordPress Plugins","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/60590","name":"http://secunia.com/advisories/60590","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"About Secunia Research | Flexera","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-5196","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5196","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"5196","vulnerable":"1","versionEndIncluding":"1.2.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"improved_user_search_in_backend_project","cpe5":"improved_user_search_in_backend","cpe6":"*","cpe7":"-","cpe8":"-","cpe9":"*","cpe10":"-","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T11:41:47.764Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://wordpress.org/plugins/improved-user-search-in-backend/changelog"},{"name":"60590","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/60590"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://security.dxw.com/advisories/csrf-and-xss-in-improved-user-search-allow-execution-of-arbitrary-javascript-in-wordpress-admin-area/"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-08-08T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the iusib_meta_fields parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-08-13T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://wordpress.org/plugins/improved-user-search-in-backend/changelog"},{"name":"60590","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/60590"},{"tags":["x_refsource_MISC"],"url":"https://security.dxw.com/advisories/csrf-and-xss-in-improved-user-search-allow-execution-of-arbitrary-javascript-in-wordpress-admin-area/"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-5196","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the iusib_meta_fields parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://wordpress.org/plugins/improved-user-search-in-backend/changelog","refsource":"MISC","url":"http://wordpress.org/plugins/improved-user-search-in-backend/changelog"},{"name":"60590","refsource":"SECUNIA","url":"http://secunia.com/advisories/60590"},{"name":"https://security.dxw.com/advisories/csrf-and-xss-in-improved-user-search-allow-execution-of-arbitrary-javascript-in-wordpress-admin-area/","refsource":"MISC","url":"https://security.dxw.com/advisories/csrf-and-xss-in-improved-user-search-allow-execution-of-arbitrary-javascript-in-wordpress-admin-area/"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-5196","datePublished":"2014-08-12T20:00:00.000Z","dateReserved":"2014-08-12T00:00:00.000Z","dateUpdated":"2024-08-06T11:41:47.764Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-08-12 20:55:03","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:improved_user_search_in_backend_project:improved_user_search_in_backend:*:-:-:*:-:wordpress:*:*","versionEndIncluding":"1.2.4","matchCriteriaId":"C6F3057D-AC4E-44E6-A44D-DAFE56129619"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"5196","Ordinal":"1","Title":"CVE-2014-5196","CVE":"CVE-2014-5196","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"5196","Ordinal":"1","NoteData":"Cross-site request forgery (CSRF) vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the iusib_meta_fields parameter.","Type":"Description","Title":"CVE-2014-5196"},{"CveYear":"2014","CveId":"5196","Ordinal":"2","NoteData":"2014-08-12","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"5196","Ordinal":"3","NoteData":"2014-08-13","Type":"Other","Title":"Modified"}]}}}