Description
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, and (5) escaping of tags within the tags meta box.
Remediation
References
Related Vulnerabilities
WordPress Plugin Site Import Remote File Inclusion (1.0.1)
OpenSSL Observable Differences in Behavior to Error Inputs Vulnerability (CVE-2019-1559)
WordPress Plugin NextGEN Gallery-WordPress Gallery 'Gallery Path' Field Cross-Site Scripting (1.9.5)
WordPress Plugin Nifty Newsletters (Formerly Sola Newsletters) Cross-Site Request Forgery (4.0.23)
Squid Improper Input Validation Vulnerability (CVE-2013-4123)