CVE-2007-4153: Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1)…

PriorityP411low2.1CVSS 2.0

AVNACHAuSCNIPAN

EPSS

2.08%

79.4th percentile

Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the Options Database Table in the Admin Panel, accessed through options.php; or (2) the opml_url parameter to link-import.php. NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfiltered_html capability.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	wordpress	< wordpress 2.2.2-1 (bookworm)	wordpress 2.2.2-1 (bookworm)
wordpress	wordpress	—	—
wordpress	wordpress	>= 0 < 2.2.2-1	2.2.2-1
wordpress	wordpress	>= 0 < 2.2.2-1	2.2.2-1
wordpress	wordpress	>= 0 < 2.2.2-1	2.2.2-1
wordpress	wordpress	>= 0 < 2.2.2-1	2.2.2-1

CVSS provenance

nvdv2.02.1LOWAV:N/AC:H/Au:S/C:N/I:P/A:N

osv2.1LOW

vendor_debian2.1LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.