WordPress CVEs

Description

wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

Affected WordPress components

• WordPress core
  Confirmed match
  Up to and including 3.3.1; Version 0.71; Version 1.0; Version 1.0.1; Version 1.0.2; Version 1.1.1; Version 1.2; Version 1.2.1; Version 1.2.2; Version 1.2.3; Version 1.2.4; Version 1.2.5; Version 1.3; Version 1.3.2; Version 1.3.3; Version 1.5; Version 1.5.1; Version 1.5.1.1; Version 1.5.1.2; Version 1.5.1.3; Version 1.5.2; Version 2.0; Version 2.0.1; Version 2.0.2; Version 2.0.4; Version 2.0.5; Version 2.0.6; Version 2.0.7; Version 2.0.8; Version 2.0.9; Version 2.0.10; Version 2.0.11; Version 2.1; Version 2.1.1; Version 2.1.2; Version 2.1.3; Version 2.2; Version 2.2.1; Version 2.2.2; Version 2.2.3; Version 2.3; Version 2.3.1; Version 2.3.2; Version 2.3.3; Version 2.5; Version 2.5.1; Version 2.6; Version 2.6.1; Version 2.6.2; Version 2.6.3; Version 2.6.5; Version 2.7; Version 2.7.1; Version 2.8; Version 2.8.1; Version 2.8.2; Version 2.8.3; Version 2.8.4; Version 2.8.5; Version 2.8.5.1; Version 2.8.5.2; Version 2.8.6; Version 2.9; Version 2.9.1; Version 2.9.1.1; Version 2.9.2; Version 3.0; Version 3.0.1; Version 3.0.2; Version 3.0.3; Version 3.0.4; Version 3.0.5; Version 3.0.6; Version 3.1; Version 3.1.1; Version 3.1.2; Version 3.1.3; Version 3.3

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• wordpress wordpress — Up to and including 3.3.1
• wordpress wordpress — Version 0.71
• wordpress wordpress — Version 1.0
• wordpress wordpress — Version 1.0.1
• wordpress wordpress — Version 1.0.2
• wordpress wordpress — Version 1.1.1
• wordpress wordpress — Version 1.2
• wordpress wordpress — Version 1.2.1
• wordpress wordpress — Version 1.2.2
• wordpress wordpress — Version 1.2.3
• wordpress wordpress — Version 1.2.4
• wordpress wordpress — Version 1.2.5
• wordpress wordpress — Version 1.3
• wordpress wordpress — Version 1.3.2
• wordpress wordpress — Version 1.3.3
• wordpress wordpress — Version 1.5
• wordpress wordpress — Version 1.5.1
• wordpress wordpress — Version 1.5.1.1
• wordpress wordpress — Version 1.5.1.2
• wordpress wordpress — Version 1.5.1.3
• wordpress wordpress — Version 1.5.2
• wordpress wordpress — Version 2.0
• wordpress wordpress — Version 2.0.1
• wordpress wordpress — Version 2.0.2
• wordpress wordpress — Version 2.0.4
• wordpress wordpress — Version 2.0.5
• wordpress wordpress — Version 2.0.6
• wordpress wordpress — Version 2.0.7
• wordpress wordpress — Version 2.0.8
• wordpress wordpress — Version 2.0.9
• wordpress wordpress — Version 2.0.10
• wordpress wordpress — Version 2.0.11
• wordpress wordpress — Version 2.1
• wordpress wordpress — Version 2.1.1
• wordpress wordpress — Version 2.1.2
• wordpress wordpress — Version 2.1.3
• wordpress wordpress — Version 2.2
• wordpress wordpress — Version 2.2.1
• wordpress wordpress — Version 2.2.2
• wordpress wordpress — Version 2.2.3
• wordpress wordpress — Version 2.3
• wordpress wordpress — Version 2.3.1
• wordpress wordpress — Version 2.3.2
• wordpress wordpress — Version 2.3.3
• wordpress wordpress — Version 2.5
• wordpress wordpress — Version 2.5.1
• wordpress wordpress — Version 2.6
• wordpress wordpress — Version 2.6.1
• wordpress wordpress — Version 2.6.2
• wordpress wordpress — Version 2.6.3
• wordpress wordpress — Version 2.6.5
• wordpress wordpress — Version 2.7
• wordpress wordpress — Version 2.7.1
• wordpress wordpress — Version 2.8
• wordpress wordpress — Version 2.8.1
• wordpress wordpress — Version 2.8.2
• wordpress wordpress — Version 2.8.3
• wordpress wordpress — Version 2.8.4
• wordpress wordpress — Version 2.8.5
• wordpress wordpress — Version 2.8.5.1
• wordpress wordpress — Version 2.8.5.2
• wordpress wordpress — Version 2.8.6
• wordpress wordpress — Version 2.9
• wordpress wordpress — Version 2.9.1
• wordpress wordpress — Version 2.9.1.1
• wordpress wordpress — Version 2.9.2
• wordpress wordpress — Version 3.0
• wordpress wordpress — Version 3.0.1
• wordpress wordpress — Version 3.0.2
• wordpress wordpress — Version 3.0.3
• wordpress wordpress — Version 3.0.4
• wordpress wordpress — Version 3.0.5
• wordpress wordpress — Version 3.0.6
• wordpress wordpress — Version 3.1
• wordpress wordpress — Version 3.1.1
• wordpress wordpress — Version 3.1.2
• wordpress wordpress — Version 3.1.3
• wordpress wordpress — Version 3.3

References

• core.trac.wordpress.org http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/capabilities.php
• core.trac.wordpress.org http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/formatting.php
• osvdb.org http://osvdb.org/81463
• secunia.com http://secunia.com/advisories/48957
• secunia.com http://secunia.com/advisories/49138
• wordpress.org http://wordpress.org/news/2012/04/wordpress-3-3-2/ Patch, Vendor Advisory
• www.debian.org http://www.debian.org/security/2012/dsa-2470
• www.securityfocus.com http://www.securityfocus.com/bid/53192
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/75093
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/75206
• nvd.nist.gov Official NVD record