CVE

Id
26595  
CVE No.
CVE-2007-3238  
Status
Candidate  
Description
Cross-site scripting (XSS) vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the PATH_INFO (REQUEST_URI) to wp-admin/themes.php, a different vulnerability than CVE-2007-1622. NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfiltered_html capability.  
Phase
Assigned (20070614)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
270007 26595 CVE-2007-3238 BUGTRAQ:20070608 Wordpress default theme XSS (admin) and other problems  View
270008 26595 CVE-2007-3238 URL:http://www.securityfocus.com/archive/1/archive/1/470837/100/0/threaded  View
270009 26595 CVE-2007-3238 MISC:http://blogsecurity.net/wordpress/news/news-100607-1/  View
270010 26595 CVE-2007-3238 MISC:http://codex.wordpress.org/Roles_and_Capabilities  View
270011 26595 CVE-2007-3238 MISC:http://www.xssnews.com/  View
270012 26595 CVE-2007-3238 MISC:http://mybeni.rootzilla.de/mybeNi/2007/wordpress_zeroday_vulnerability_roundhouse_kick_and_why_i_nearly_wrote_the_first_blog_worm/  View
270013 26595 CVE-2007-3238 DEBIAN:DSA-1502  View
270014 26595 CVE-2007-3238 URL:http://www.debian.org/security/2008/dsa-1502  View
270015 26595 CVE-2007-3238 BID:25161  View
270016 26595 CVE-2007-3238 URL:http://www.securityfocus.com/bid/25161  View
270017 26595 CVE-2007-3238 OSVDB:37293  View
270018 26595 CVE-2007-3238 URL:http://osvdb.org/37293  View
270019 26595 CVE-2007-3238 SECUNIA:29014  View
270020 26595 CVE-2007-3238 URL:http://secunia.com/advisories/29014  View
270021 26595 CVE-2007-3238 SECUNIA:25541  View
270022 26595 CVE-2007-3238 URL:http://secunia.com/advisories/25541/  View
270023 26595 CVE-2007-3238 SREASON:2807  View
270024 26595 CVE-2007-3238 URL:http://securityreason.com/securityalert/2807  View
270025 26595 CVE-2007-3238 XF:wordpress-themes-xss(34785)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
57005 JVNDB-2007-005697 WordPress 用の Vistered-Little テーマの 404.php におけるクロスサイトスクリプティングの脆弱性 WordPress 用の Vistered-Little テーマの 404.php には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2007-3240 26595 4.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-005697.html  View