vendor:
Wordpress
by:
Not specified
5.5
CVSS
MEDIUM
Cross-Site Scripting (XSS)
79
CWE
Product Name: Wordpress
Affected Version From: 2.1.2001
Affected Version To: Unknown
Patch Exists: YES
Related CWE: CVE-2007-2022
CPE: a:wordpress:wordpress:2.1.1
Metasploit:
https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2022-41966/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2022-2007/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2022-2007/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2022-2007/, https://www.rapid7.com/db/vulnerabilities/microsoft-edge-cve-2022-2007/, https://www.rapid7.com/db/vulnerabilities/google-chrome-cve-2022-2007/, https://www.rapid7.com/db/vulnerabilities/freebsd-cve-2022-2007/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2011-1090/, https://www.rapid7.com/db/vulnerabilities/adobe-flash-apsb07-12-cve-2007-2022/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2007-0494/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-CESA-2007-0494/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2007-2022/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2007-2022/
Platforms Tested:
2007
Cross-Site Scripting in WordPress
The vulnerability allows an attacker to execute arbitrary script code in the browser of an unsuspecting user, potentially leading to the theft of authentication credentials and other attacks.
Mitigation:
Apply the latest security patches or upgrade to a non-affected version of Wordpress.
