Description

Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.

Remediation

References

CVE-2007-1049

Related Vulnerabilities

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-2031)

Chamilo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-31807)

WordPress Plugin JobBoardWP-Job Board Listings and Submissions Cross-Site Scripting (1.0.7)

WordPress Plugin Click to Call or Chat Buttons Cross-Site Scripting (1.4.0)

Envoy Proxy Improper Certificate Validation Vulnerability (CVE-2022-21657)

Severity

Medium

Classification

CVE-2007-1049

Tags

Missing Update Known Vulnerabilities