CVE-2004-1559 WordPress Core < 1.2.1 - Cross-Site Scripting
MediumCVSS 4.3
EPSS 6.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or popuptitle parameters to wp-login.php, (2) redirect_url parameter to admin-header.php, (3) popuptitle, popupurl, content, or post_title parameters to bookmarklet.php, (4) cat_ID parameter to categories.php, (5) s parameter to edit.php, or (6) s or mode parameter to edit-comments.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress | = 1.2 | No fix listed |
| debian/wordpress(Debian:12) | < 1.2.2-1.1 | 1.2.2-1.1 |
| debian/wordpress(Debian:13) | < 1.2.2-1.1 | 1.2.2-1.1 |
| debian/wordpress(Debian:14) | < 1.2.2-1.1 | 1.2.2-1.1 |
| WordPress(WordPress) | < 1.2 | 1.2 |
References
- 20040927 Multiple XSS Vulnerabilities in Wordpress 1.2 mailing-list
- 12683 exploit third-party-advisory vendor-advisory
- 1011440 vdb-entry
- 11268 exploit patch vdb-entry
- wordpress-multiple-scripts-xss(17532) vdb-entry
- Debian Security Tracker CVE-2004-1559 vendor-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org