Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2007-1049 — Cross-site Scripting in Wordpress
11 documents6 sources
Severity
5.8MEDIUMNVD
NVD4.3OSV4.3
EPSS
6.2%
top 9.08%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedFeb 21
Latest updateMay 1
Description
Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.
CVSS vector
AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9
Affected Packages3 packages
Patches
🔴Vulnerability Details
4GHSA▶
GHSA-5c83-v5f6-vqjc: Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions↗2022-05-01
GHSA▶
GHSA-pqc9-8ghg-8vc2: Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions↗2022-05-01
OSV▶
CVE-2007-1230: Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions↗2007-03-02
OSV▶
CVE-2007-1049: Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions↗2007-02-21