← Back

CVE-2007-1049

nvd nist
Published: Feb 21, 2007Modified: Apr 23, 2026

JSON object

Loading...
4.3
Vector
AV:N/AC:M/Au:N/C:N/I:P/A:N
Exploitability: 8.6 / Impact: 2.9
Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.

Affected (20)

Products: Wordpress: Wordpress
Wordpress
1 product
Wordpress
Configuration A
18 vulnerable
Vulnerable SoftwareAffected Versions
Wordpress
Wordpress
Version 0.6.2.1 beta_2
Wordpress
Version 0.6.2 beta_2
Wordpress
Version 0.71
Wordpress
Version 0.7
Wordpress
Version 1.2.2
Wordpress
Version 1.5.1.2
Wordpress
Version 1.5.1.3
Wordpress
Version 1.5.1
Wordpress
Version 1.5.2
Wordpress
Version 1.5
Wordpress
Version 2.0.1
Wordpress
Version 2.0.2
Wordpress
Version 2.0.3
Wordpress
Version 2.0.4
Wordpress
Version 2.0.5
Wordpress
Version 2.0.6
Wordpress
Version 2.0.7
Wordpress
Version 2.0
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Wordpress
Version 1.2
Running on/withPlatform Versions
Gentoo
Linux
Version 1.4
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Wordpress
Version 1.2.1
Running on/withPlatform Versions
Gentoo
Linux
All versions

References (20)

Source: cve@mitre.org
Exploit
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Patch
Source: cve@mitre.org
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.