CVE-2014-2040

CVE-2014-2040 describes multiple cross-site scripting (XSS) vulnerabilities found in the Media File Renamer plugin 1.7.0 for WordPress. Specifically, the callback_multicheck, callback_radio, and callback_wysiwygin functions in mfrh_class.settings-api.php are susceptible to script injection. This vulnerability allows remote authenticated users with media management permissions to inject arbitrary web script or HTML, for instance, through the title of an uploaded file. The vulnerability has a CVSS score indicating low severity, with an attack vector requiring network access but high attack complexity and authenticated user interaction. The potential impact is limited to partial integrity compromise (XSS), with no confidentiality or availability impact. The EPSS and FAUCET Risk Score are very low, suggesting a minimal threat. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are virtually nonexistent, indicating a lack of widespread attention or concern.