CVE-2012-2403 — Cross-site Scripting in Wordpress

CWE-79 — Cross-site Scripting6 documents5 sources

Severity

4.3MEDIUMNVD

EPSS

3.1%

top 13.12%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Wordpress Debian Wordpress

Timeline

PublishedApr 21

Latest updateMay 17

Description

wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/wordpress< wordpress 3.3.2+dfsg-1 (bookworm)

▶Debianwordpress/wordpress< 3.3.2+dfsg-1+3

▶NVDwordpress/wordpress3.3.1+77

Patches

Patch: wordpress.org ↗Patch: wordpress.org ↗

🔴Vulnerability Details

GHSA

GHSA-jqgf-33rj-9cwr: wp-includes/formatting↗2022-05-17

▶

OSV

CVE-2012-2403: wp-includes/formatting↗2012-04-21

▶

📋Vendor Advisories

Debian

CVE-2012-2403: wordpress - wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickabl...↗2012

▶

💬Community

Bugzilla

CVE-2012-2399 CVE-2012-2400 CVE-2012-2402 CVE-2012-2403 CVE-2012-2404 wordpress various flaws [epel-5]↗2012-04-23

▶

Bugzilla

CVE-2012-2403 wordpress (X < v3.3.2): XSS when making URLs clickable↗2012-04-23

▶