WordPress CVEs

Description

Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 and 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the user_email parameter.

Affected WordPress components

• WordPress core
  Confirmed match
  Version 2.0; Version 2.0.1

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Version 2.0
• wordpress wordpress — Version 2.0.1

References

• blogsecurity.net http://blogsecurity.net/wordpress/2-vanilla-xss-on-wordpress-wp-registerphp/
• securityreason.com http://securityreason.com/securityalert/3175
• www.securityfocus.com http://www.securityfocus.com/archive/1/480327/100/0/threaded
• www.securityfocus.com http://www.securityfocus.com/bid/25769
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/36742
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/36743
• nvd.nist.gov Official NVD record