# CVE-2016-4567: MediaElement.js Reflected XSS in FlashMediaElement component

Source: https://junglewise.ai/threats/cve-2016-4567-mediaelement-js-reflected-xss-in-flashmediaelement-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-17. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-4567 · Severity: low · CVSS 3 · Published 2022-05-17

MediaElement.js is a popular media player library used by content management systems like WordPress and Contao to handle video and audio. A security flaw in its Flash component allows attackers to perform 'Reflected Cross-Site Scripting' (XSS) by tricking a user into clicking a malicious link. If successful, an attacker could execute unauthorized scripts in the user's browser, potentially leading to the theft of session cookies, account takeover, or the defacement of the website.

Technologies: [Contao](https://junglewise.ai/threats/technologies/contao), [contao/core (Packagist)](https://junglewise.ai/threats/technologies/contao-core), [Wordpress](https://junglewise.ai/threats/technologies/wordpress). Vendors: [Contao](https://junglewise.ai/threats/vendors/contao), [npm](https://junglewise.ai/threats/vendors/npm), [Packagist](https://junglewise.ai/threats/vendors/packagist), [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2016-4567 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-4567 being exploited in the wild.

**How severe is CVE-2016-4567?** Low severity, with a CVSS score of 3, published 17 May 2022.

**Which products and versions are affected?** Contao 3.0.0 - 3.5.14; John Dyer MediaElement.js < 2.21.0; mediaelement (npm) SEMVER:introduced=0,fixed=2.11.1; contao-components/mediaelement (Packagist) ECOSYSTEM:introduced=2.14.2,fixed=2.21.1; and 2 more.

**Is there a fix for CVE-2016-4567?** Yes. mediaelement (npm): upgrade to 2.11.1 or later; contao-components/mediaelement (Packagist): upgrade to 2.21.1 or later; contao/core (Packagist): upgrade to 3.5.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-4567 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2016-4567?** Check whether you run Contao, John Dyer MediaElement.js, mediaelement (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mediaelement (npm): upgrade to 2.11.1 or later

  ```sh
  npm install mediaelement@2.11.1
  ```

- contao-components/mediaelement (Packagist): upgrade to 2.21.1 or later

  ```sh
  composer require contao-components/mediaelement:^2.21.1
  ```

- contao/core (Packagist): upgrade to 3.5.15 or later

  ```sh
  composer require contao/core:^3.5.15
  ```


## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the 'flash/FlashMediaElement.as' (and compiled .swf) component of MediaElement.js. The root cause is an ineffective sanitization routine that attempts to strip GET parameters from 'flashVars' to prevent external manipulation of 'ExternalInterface' calls. Attackers can bypass this protection using an obfuscated parameter name (e.g., 'jsinitfunctio%gn') to inject arbitrary JavaScript. This vulnerability was widely distributed via its inclusion in WordPress (versions 4.2 through 4.5.1) and Contao. Exploitation requires a victim to visit a specially crafted URL. The issue is resolved in MediaElement.js version 2.21.0 and later.

## Affected products

- John Dyer MediaElement.js < 2.21.0
- WordPress WordPress 4.2 - 4.5.1
- Contao Contao 3.0.0 - 3.5.14

## Identifiers

- CVE-2016-4567
- GHSA-277w-qpxr-2549

## Timeline

- 2016-04-01: disclosed: Reported to WordPress via HackerOne by Cure53 team
- 2016-05-06: patched: WordPress 4.5.2 released with fix
- 2016-05-17: advisory: GitHub Advisory published
- 2016-07-15: patched: Contao 3.5.15 released with fix

## References

- [https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e](https://github.com/johndyer/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e)
- [https://github.com/mediaelement/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e](https://github.com/mediaelement/mediaelement/commit/34834eef8ac830b9145df169ec22016a4350f06e)
- [https://codex.wordpress.org/Version_4.5.2](https://codex.wordpress.org/Version_4.5.2)
- [https://contao.org/en/news/contao-3_5_15.html](https://contao.org/en/news/contao-3_5_15.html)
- [https://core.trac.wordpress.org/changeset/37371](https://core.trac.wordpress.org/changeset/37371)
- [https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c](https://gist.github.com/cure53/df34ea68c26441f3ae98f821ba1feb9c)

## Related threats

- [Contao path traversal in image insert tag](https://junglewise.ai/threats/cve-2026-126663-contao-4-0-0-before-5-3-54-5-4-0-before-5-7-17-and-6-0-0-before)
- [Contao access control bypass in file manager Edit-Multiple](https://junglewise.ai/threats/cve-2026-126662-contao-4-0-0-before-5-3-54-5-4-0-before-5-7-17-and-6-0-0-before)
- [Contao improper access control in table access voter](https://junglewise.ai/threats/cve-2026-107851-contao-improper-access-control-in-the-table-access-voter)
- [Contao improper access control in preview links module](https://junglewise.ai/threats/cve-2026-107850-contao-improper-access-control-in-the-preview-links-module)
- [Contao path traversal in job attachment downloads](https://junglewise.ai/threats/cve-2026-55825-contao-path-traversal-in-job-attachment-downloads)