CVE-2008-0192

WordPress < 2.0.9 - Cross-Site Scripting via popuptitle Parameter

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2008-0192. PoCs published by 3APA3A.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in WordPress by injecting malicious JavaScript via the 'popuptitle' parameter in the post.php URL. The payload uses the 'expression' CSS property to execute arbitrary JavaScript, specifically an alert displaying the document cookie.

Description

Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the popuptitle parameter to (1) wp-admin/post.php or (2) wp-admin/page-new.php.

Exploits (2)

exploitdb WORKING POC VERIFIED

by 3APA3A · textwebappsphp

https://www.exploit-db.com/exploits/30977

View Code ZIP pw:eip

This exploit demonstrates a cross-site scripting (XSS) vulnerability in WordPress by injecting malicious JavaScript via the 'popuptitle' parameter in the post.php URL. The payload uses the 'expression' CSS property to execute arbitrary JavaScript, specifically an alert displaying the document cookie.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: WordPress (versions affected by CVE-2008-0192)

No auth needed

Prerequisites: Access to a vulnerable WordPress installation · Victim interaction required (e.g., clicking a malicious link)

MITRE ATT&CK

T1059.007 - JavaScript

devstral-2 · analyzed Feb 16, 2026 Full analysis →