CVE-2009-3891
published 2009-11-17CVE-2009-3891: Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script…
PriorityP413low3.5CVSS 2.0
AVNACMAuSCNIPAN
EPSS
2.10%
79.8th percentile
Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter (aka the selection variable).
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 2.8.6-1 (bookworm) | wordpress 2.8.6-1 (bookworm) |
| wordpress | wordpress | <= 2.8.5 | — |
| wordpress | wordpress | >= 0 < 2.8.6-1 | 2.8.6-1 |
| wordpress | wordpress | >= 0 < 2.8.6-1 | 2.8.6-1 |
| wordpress | wordpress | >= 0 < 2.8.6-1 | 2.8.6-1 |
| wordpress | wordpress | >= 0 < 2.8.6-1 | 2.8.6-1 |
CVSS provenance
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv3.5LOW
vendor_debian3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8wqr-ch99-7r8g: Cross-site scripting (XSS) vulnerability in wp-admin/press-this
ghsa_unreviewed·2022-05-02
CVE-2009-3891 [LOW] CWE-79 GHSA-8wqr-ch99-7r8g: Cross-site scripting (XSS) vulnerability in wp-admin/press-this
Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter (aka the selection variable).
OSV
CVE-2009-3891: Cross-site scripting (XSS) vulnerability in wp-admin/press-this
osv·2009-11-17·CVSS 3.5
CVE-2009-3891 [LOW] CVE-2009-3891: Cross-site scripting (XSS) vulnerability in wp-admin/press-this
Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter (aka the selection variable).
Debian
CVE-2009-3891: wordpress - Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress...
vendor_debian·2009·CVSS 3.5
CVE-2009-3891 [LOW] CVE-2009-3891: wordpress - Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress...
Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter (aka the selection variable).
Scope: local
bookworm: resolved (fixed in 2.8.6-1)
bullseye: resolved (fixed in 2.8.6-1)
forky: resolved (fixed in 2.8.6-1)
sid: resolved (fixed in 2.8.6-1)
trixie: resolved (fixed in 2.8.6-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://core.trac.wordpress.org/attachment/ticket/11119/press-this-xss-bug-11-10-2009.patchhttp://core.trac.wordpress.org/attachment/ticket/11119/press-this.002.diffhttp://core.trac.wordpress.org/ticket/11119http://secunia.com/advisories/37332http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/http://www.openwall.com/lists/oss-security/2009/11/15/2http://www.openwall.com/lists/oss-security/2009/11/15/3http://www.openwall.com/lists/oss-security/2009/11/16/1http://www.osvdb.org/59959http://core.trac.wordpress.org/attachment/ticket/11119/press-this-xss-bug-11-10-2009.patchhttp://core.trac.wordpress.org/attachment/ticket/11119/press-this.002.diffhttp://core.trac.wordpress.org/ticket/11119http://secunia.com/advisories/37332http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/http://www.openwall.com/lists/oss-security/2009/11/15/2http://www.openwall.com/lists/oss-security/2009/11/15/3http://www.openwall.com/lists/oss-security/2009/11/16/1http://www.osvdb.org/59959
2009-11-17
Published