Description
wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote attackers to bypass intended spam restrictions via a crafted URL, as demonstrated by a URL that triggers a substring match.
Remediation
References
Related Vulnerabilities
WordPress Plugin Contact Bank-Contact Form Builder for WordPress Cross-Site Scripting (2.1.23)
WordPress Plugin Chat-Support Board-WordPress Chat Privilege Escalation (3.3.8)
WordPress Plugin Form for WordPress-Zoho Forms Cross-Site Scripting (3.0)
Internet Information Services Other Vulnerability (CVE-1999-0737)