CVE-2007-1732

WordPress 2.1.2 - Authenticated Cross-Site Scripting via Demo Parameter

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: another researcher disputes this issue, stating that this is legitimate functionality for administrators. However, it has been patched by at least one vendor

References (6)

Core 6
Core References
Broken Link vdb-entry x_refsource_osvdb
http://osvdb.org/33884
Permissions Required, Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/24566
Permissions Required, Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/24430
Third Party Advisory vendor-advisory x_refsource_gentoo
http://www.gentoo.org/security/en/glsa/glsa-200703-23.xml
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=117319839710382&w=2

Scores

EPSS 0.0052
EPSS Percentile 67.1%

Details

CWE
CWE-79
Status published
Products (1)
wordpress/wordpress 2.1.2
Published Mar 28, 2007
Tracked Since Feb 18, 2026