Description

** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance.

Remediation

References

CVE-2012-0782

Related Vulnerabilities

WordPress Plugin Uncanny Toolkit for LearnDash Cross-Site Request Forgery (3.6.4.1)

Oracle JRE CVE-2019-2949 Vulnerability (CVE-2019-2949)

WordPress Plugin Product Size charts for Woocommerce Unspecified Vulnerability (1.0)

phpMyAdmin Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-26935)

DOMPurify URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2019-25155)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2012-0782