Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0 as used in WordPress before 4.5.2 allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter as demonstrated by \jsinitfunctio%gn.\