CVE-2007-5710 WordPress Core <= 2.3 - Cross-Site Scripting
LowCVSS 2.6
EPSS 7.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inject arbitrary web script or HTML via the posts_columns array parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress(WordPress) | < 2.3.1 | 2.3.1 |
| WordPress | = 2.3 | No fix listed |
| debian/wordpress(Debian:12) | < 2.3.1-1 | 2.3.1-1 |
| debian/wordpress(Debian:13) | < 2.3.1-1 | 2.3.1-1 |
| debian/wordpress(Debian:14) | < 2.3.1-1 | 2.3.1-1 |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- 38279 vdb-entry
- 27407 patch third-party-advisory vendor-advisory
- wordpress.org patch
- 20071027 [waraxe-2007-SA#059] - XSS in WordPress 2.3 mailing-list
- 26228 vdb-entry
- ADV-2007-3640 vdb-entry
- www.waraxe.us
- wordpress-editpostrows-xss(38166) vdb-entry
- Debian Security Tracker CVE-2007-5710 vendor-advisory