Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2007-5105 — Cross-site Scripting in Wordpress

CWE-79 — Cross-site Scripting5 documents5 sources

Severity

4.3MEDIUMNVD

EPSS

1.7%

top 17.77%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Wordpress Debian Wordpress

Timeline

PublishedSep 26

Latest updateMay 1

Description

Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 and 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the user_email parameter.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 2.0.4-1 (bookworm)

▶Debianwordpress/wordpress< 2.0.4-1+3

▶NVDwordpress/wordpress2.0, 2.0.1+1

🔴Vulnerability Details

GHSA

GHSA-jpj9-pwx9-945j: Cross-site scripting (XSS) vulnerability in wp-register↗2022-05-01

▶

OSV

CVE-2007-5105: Cross-site scripting (XSS) vulnerability in wp-register↗2007-09-26

▶

💥Exploits & PoCs

Exploit-DB

WordPress Core 2.0 - 'wp-register.php' Multiple Cross-Site Scripting Vulnerabilities↗2007-09-22

▶

📋Vendor Advisories

Debian

CVE-2007-5105: wordpress - Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 and...↗2007

▶