Description

WordPress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. WordPress version 2.3 is vulnerable.

Remediation

Update to WordPress version 2.3.1 or latest

References

http://www.waraxe.us/advisory-59.html

http://www.securityfocus.com/archive/1/482905

http://packetstormsecurity.org/files/view/60477/waraxe-2007-SA059.txt

http://secunia.com/advisories/27407/

https://wordpress.org/news/2007/10/wordpress-231/

Related Vulnerabilities

WordPress Plugin WordPress Popular Posts Cross-Site Scripting (5.3.3)

Grafana Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2021-43813)

TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-31048)

Oracle JRE CVE-2013-2430 Vulnerability (CVE-2013-2430)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-1756)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update XSS CWE-79 CVE-2007-5710