Description

wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the message variable, which is not initialized before use.

Remediation

References

CVE-2005-2109

Related Vulnerabilities

WordPress Plugin Share Buttons Cross-Site Scripting (1.3.1)

WordPress Plugin myghpay WooCommerce Payment Gateway Cross-Site Scripting (3.0)

Oracle Database Server CVE-2012-0552 Vulnerability (CVE-2012-0552)

WordPress Plugin WP Database Backup Cross-Site Scripting (5.1.1)

WordPress Plugin Church Admin Cross-Site Scripting (0.856)

Severity

Medium

Classification

CVE-2005-2109

Tags

Missing Update Known Vulnerabilities