WordPress component: Cross-site scripting

WordPress component is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

CVE / CNA score 2.1 CVSS · cve@mitre.org

NVD score 2.1 CVSS 2.0 · nvd@nist.gov

Component: WordPress component
Plugin slug: Core
Affected: See vendor advisory
Safe version: See mitigation notes
Published: Aug 03, 2007
Weakness: NVD-CWE-Other

This CVE was published Aug 03, 2007 and is one of 45 known issues for WordPress core.

What to do

Patch or disable the affected component.

Update WordPress component to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the Options Database Table in the Admin Panel, accessed through options.php; or (2) the opml_url parameter to link-import.php. NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfiltered_html capability.

NVD vector: AV:N/AC:H/Au:S/C:N/I:P/A:N

References

Patch or disable the affected component.

Technical description

Primary and upstream sources