How it was found

Hi tream,

veris.in is vulnerable reflected XSS that stems from an insecure URL sanitization process performed in the file flashmediaelement.swf

PoC:

https://www.veris.in/wp-includes/js/mediaelement/flashmediaelement.swf?jsinitfunctio%gn=alert`1`

Fix:

Update to WordPress 4.5.2

regards, aziose