CVE-2013-1463: XSS in WP-Table Reloaded's zeroclipboard SWF
CVE-2013-1463 sits in the same family as CVE-2013-1464, found around the same time in a different WordPress plugin. WP-Table Reloaded, used to build and manage tables without writing HTML, bundled a small SWF utility called zeroclipboard to handle copy-to-clipboard functionality for table data.
How the flaw worked
The zeroclipboard SWF read an identifier from its flashvars, the same URL-driven configuration mechanism described in the Audio Player case, and stored it directly as a property used in an ActionScript bridge call back out to JavaScript on the page. Because that identifier was never validated or encoded before being used, a crafted value could break out of the expected string context and inject script that ran when the bridge call fired. The practical effect was the same as CVE-2013-1464: a link to the vulnerable SWF, carrying a malicious parameter value, would execute attacker-controlled script in the browser of anyone who followed it on a site running the plugin.
Why the same bug kept turning up
Flash-to-JavaScript bridges, of which zeroclipboard was a widely reused example across many WordPress plugins and themes, were a common source of this exact mistake: a value trusted to arrive from the SWF's own embedding page was treated as safe by the bridge code, when in fact anyone could control it by crafting the URL that loaded the SWF in the first place. Because the same zeroclipboard component was reused across many unrelated projects, the same unsanitised-flashvar pattern surfaced in more than one plugin separately.
The fix
The vendor patched the issue by sanitising the id parameter before it reached the ActionScript-to-JavaScript bridge call, and shipped the fix within days of being notified, alongside a small bug bounty reward credited in the original advisory.
Takeaway for today
Even though SWF-based components are gone from modern browsers, the underlying failure, trusting a parameter because it arrived through an apparently internal communication channel rather than validating it on its own merits, still appears in modern equivalents such as postMessage handlers between an iframe and its parent page. Any bridge between two execution contexts needs to validate what crosses it, regardless of which side is assumed to be "trusted".
Key takeaways
- CVE-2013-1463 was an XSS in the zeroclipboard SWF bundled with WP-Table Reloaded
- An unsanitised id flashvar reached an ActionScript-to-JavaScript bridge call unescaped
- The same vulnerable zeroclipboard component was reused across multiple unrelated plugins
- The vendor fix sanitised the parameter before the bridge call, patched within days
- The core lesson transfers to modern bridges like postMessage: validate anything crossing an execution-context boundary
This note has been rewritten and checked for this edition; it is not a copy of the original post.