CVE-2009-2851

WordPress < 2.8.2 - Cross-Site Scripting via Comment Author URL

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-2851. PoCs published by superfreakaz0rz.

AI-analyzed exploit summary This exploit targets a stored XSS vulnerability in WordPress (CVE-2009-2851) by injecting malicious JavaScript into the comment URL field. The payload triggers when an admin mouses over the comment author's name, executing arbitrary JavaScript in the context of the admin session.

Description

Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via a comment author URL.

Exploits (1)

exploitdb WORKING POC VERIFIED

by superfreakaz0rz · bashwebappsphp

https://www.exploit-db.com/exploits/9250

View Code ZIP pw:eip

This exploit targets a stored XSS vulnerability in WordPress (CVE-2009-2851) by injecting malicious JavaScript into the comment URL field. The payload triggers when an admin mouses over the comment author's name, executing arbitrary JavaScript in the context of the admin session.

Classification

Working Poc 95%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: WordPress (versions prior to 2.8.2)

No auth needed

Prerequisites: Target WordPress site with comment functionality enabled · Admin interaction (mouse-over) required for payload execution

MITRE ATT&CK