{"data":{"id":"CVE-2009-4168","cve_id":"CVE-2009-4168","title":"Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and…","summary":"Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and…","severity":"MEDIUM","cvss":{"score":4.3,"version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","source":"nvd"},"published_at":"2009-12-02T18:30:00.313000Z","modified_at":"2026-06-16T23:13:10.220000Z","withdrawn_at":null,"is_joomla":true,"is_joomla_core":false,"relevance":"probable","product":"Extension Joomla (identification incertaine)","extension":{"type":null,"name":null},"sources":["nvd"],"source_count":1,"url":"https://cve.oyer.fr/cve/CVE-2009-4168","description":"Cross-site scripting (XSS) vulnerability in Roy Tanck tagcloud.swf, as used in the WP-Cumulus plugin before 1.23 for WordPress and the Joomulus module 2.0 and earlier for Joomla!, allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter in a tags action. Cross-site scripting (XSS) vulnerability in tagcloud.swf in the WP-Cumulus Plug-in before 1.23 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tagcloud parameter.","cwe":["CWE-79"],"affected":[{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:*:*:*:*:*:*:*:*","version_start":null,"version_end":"1.22","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.00:*:*:*:*:*:*:*","version_start":"1.00","version_end":"1.00","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.01:*:*:*:*:*:*:*","version_start":"1.01","version_end":"1.01","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.02:*:*:*:*:*:*:*","version_start":"1.02","version_end":"1.02","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.2.1:*:*:*:*:*:*:*","version_start":"1.2.1","version_end":"1.2.1","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.03:*:*:*:*:*:*:*","version_start":"1.03","version_end":"1.03","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.04:*:*:*:*:*:*:*","version_start":"1.04","version_end":"1.04","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.05:*:*:*:*:*:*:*","version_start":"1.05","version_end":"1.05","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.10:*:*:*:*:*:*:*","version_start":"1.10","version_end":"1.10","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.11:*:*:*:*:*:*:*","version_start":"1.11","version_end":"1.11","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.12:*:*:*:*:*:*:*","version_start":"1.12","version_end":"1.12","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.13:*:*:*:*:*:*:*","version_start":"1.13","version_end":"1.13","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.14:*:*:*:*:*:*:*","version_start":"1.14","version_end":"1.14","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.15:*:*:*:*:*:*:*","version_start":"1.15","version_end":"1.15","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.16:*:*:*:*:*:*:*","version_start":"1.16","version_end":"1.16","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.17:*:*:*:*:*:*:*","version_start":"1.17","version_end":"1.17","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.18:*:*:*:*:*:*:*","version_start":"1.18","version_end":"1.18","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.19:*:*:*:*:*:*:*","version_start":"1.19","version_end":"1.19","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"},{"package":null,"product":"wp-cumulus","vendor":"roytanck","ecosystem":null,"cpe":"cpe:2.3:a:roytanck:wp-cumulus:1.20:*:*:*:*:*:*:*","version_start":"1.20","version_end":"1.20","version_end_inclusive":true,"fixed_version":null,"type":null,"source":"nvd"}],"references":[{"url":"http://packetstormsecurity.org/1001-exploits/joomlajvclouds-xss.txt","title":null,"source":"nvd"},{"url":"http://secunia.com/advisories/37483","title":"Vendor Advisory","source":"nvd"},{"url":"http://secunia.com/advisories/38161","title":null,"source":"nvd"},{"url":"http://websecurity.com.ua/3665/","title":"Exploit","source":"nvd"},{"url":"http://websecurity.com.ua/3789/","title":null,"source":"nvd"},{"url":"http://websecurity.com.ua/3801/","title":null,"source":"nvd"},{"url":"http://websecurity.com.ua/3839/","title":null,"source":"nvd"},{"url":"http://www.roytanck.com/2009/11/15/wp-cumulus-updated-to-address-yet-another-security-issue/","title":"Vendor Advisory","source":"nvd"},{"url":"http://www.securityfocus.com/archive/1/508071/100/0/threaded","title":null,"source":"nvd"},{"url":"http://www.securityfocus.com/archive/1/508606/100/0/threaded","title":null,"source":"nvd"},{"url":"http://www.securityfocus.com/archive/1/508833/100/0/threaded","title":null,"source":"nvd"},{"url":"http://www.securityfocus.com/bid/37100","title":"Exploit","source":"nvd"},{"url":"http://www.securityfocus.com/bid/37479","title":null,"source":"nvd"},{"url":"http://www.vupen.com/english/advisories/2009/3322","title":"Vendor Advisory","source":"nvd"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54397","title":null,"source":"nvd"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/55156","title":null,"source":"nvd"}],"source_records":[{"source":"nvd","external_id":"CVE-2009-4168","url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4168","severity":"MEDIUM","cvss_score":4.3,"cvss_vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","cvss_version":"2.0","first_seen_at":"2026-09-26T09:27:11.853303Z","last_seen_at":"2026-09-26T09:34:01.680933Z"}],"history":[{"at":"2026-09-26T09:27:11.853303Z","event":"created","source":"nvd","detail":"Détectée via nvd"}]}}