WordPress CVEs

Description

Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.

Affected WordPress components

• WordPress core
  Confirmed match
  Version 0.6.2; Version 0.6.2.1; Version 0.7; Version 0.71; Version 1.2.2; Version 1.5; Version 1.5.1; Version 1.5.1.2; Version 1.5.1.3; Version 1.5.2; Version 2.0; Version 2.0.1; Version 2.0.2; Version 2.0.3; Version 2.0.4; Version 2.0.5; Version 2.0.6; Version 2.0.7; Version 1.2; Version 1.2.1

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Version 0.6.2
• wordpress wordpress — Version 0.6.2.1
• wordpress wordpress — Version 0.7
• wordpress wordpress — Version 0.71
• wordpress wordpress — Version 1.2.2
• wordpress wordpress — Version 1.5
• wordpress wordpress — Version 1.5.1
• wordpress wordpress — Version 1.5.1.2
• wordpress wordpress — Version 1.5.1.3
• wordpress wordpress — Version 1.5.2
• wordpress wordpress — Version 2.0
• wordpress wordpress — Version 2.0.1
• wordpress wordpress — Version 2.0.2
• wordpress wordpress — Version 2.0.3
• wordpress wordpress — Version 2.0.4
• wordpress wordpress — Version 2.0.5
• wordpress wordpress — Version 2.0.6
• wordpress wordpress — Version 2.0.7
• wordpress wordpress — Version 1.2
• wordpress wordpress — Version 1.2.1

References

• downloads.securityfocus.com http://downloads.securityfocus.com/vulnerabilities/exploits/22534.html Exploit
• osvdb.org http://osvdb.org/33766
• secunia.com http://secunia.com/advisories/24306
• secunia.com http://secunia.com/advisories/24566
• trac.wordpress.org http://trac.wordpress.org/changeset/4876 Patch
• trac.wordpress.org http://trac.wordpress.org/changeset/4877
• trac.wordpress.org http://trac.wordpress.org/ticket/3781 Vendor Advisory
• www.gentoo.org http://www.gentoo.org/security/en/glsa/glsa-200703-23.xml
• www.securityfocus.com http://www.securityfocus.com/bid/22534
• www.vupen.com http://www.vupen.com/english/advisories/2007/0741
• nvd.nist.gov Official NVD record