CVE-2007-4104 FeedStats < 2.4 - Cross-Site Scripting
MediumCVSS 4.3
EPSS 5.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, one of which involves an rss2 feed with an invalid or missing blog with an XSS sequence in the query string.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wp-feedstats wordpress plugin | <= 2.1 | No fix listed |
| wordpress feedstats-de(WordPress) | < 2.4 | 2.4 |
References
- blogsecurity.net
- blogsecurity.net
- bueltge.de patch
- 20070726 WordPress wp-feedstats persistent XSS exploit mailing-list
- 37259 vdb-entry
- 26249 patch third-party-advisory vendor-advisory
- 25085 exploit patch vdb-entry
- wordpress-wpfeedstats-xss(35646) vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org