CVE-2007-4153
LOW
2.1
CVSS 2.0
Description
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the Options Database Table in the Admin Panel, accessed through options.php; or (2) the opml_url parameter to link-import.php. NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfiltered_html capability.
Affected WordPress components
-
WordPress coreVersion 2.2.1
A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.
Affected products and versions
- n/a n/a — Versions not specified
- wordpress wordpress — Version 2.2.1
References
- codex.wordpress.org http://codex.wordpress.org/Roles_and_Capabilities
- mybeni.rootzilla.de http://mybeni.rootzilla.de/mybeNi/2007/wordpress_zeroday_vulnerability_roundhouse_kick_and_why_i_nearly_wrote_the_first_blog_worm/ Exploit
- osvdb.org http://osvdb.org/46994
- osvdb.org http://osvdb.org/46995
- secunia.com http://secunia.com/advisories/30013
- www.debian.org http://www.debian.org/security/2008/dsa-1564
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/35720
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/35722
- nvd.nist.gov Official NVD record