CVE-2007-1894: XSS
Published Apr 9, 2007
·Updated
Cross-site scripting (XSS) vulnerability in wp-includes/general-template.php in WordPress before 20070309 allows remote attackers to inject arbitrary web script or HTML via the year parameter in the wptitle function.
Affected Software
12 affected components
WordPress=2.0
WordPress=2.1.1
WordPress=2.0.2
WordPress=2.1
WordPress=2.0.6
WordPress=2.0.1
WordPress=2.0.4
WordPress=2.0.7
WordPress=2.1.2
WordPress=2.0.5
WordPress=2.0.3
WordPress=2.2_revision5002
Remediation
Patch Available
Patch Available
Event History
Apr 9, 2007
CVE Published
08:19 PM
Apr 10, 2007
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-1894?
CVE-2007-1894 is considered a medium severity vulnerability due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2007-1894?
To fix CVE-2007-1894, upgrade your WordPress installation to a version later than 2.1.2.
3
What does CVE-2007-1894 affect?
CVE-2007-1894 affects various versions of WordPress prior to 2.1.2.
4
Can CVE-2007-1894 allow an attacker to execute scripts?
Yes, CVE-2007-1894 allows attackers to inject arbitrary web scripts or HTML, leading to potential cross-site scripting.
5
What function is compromised in CVE-2007-1894?
CVE-2007-1894 compromises the wp_title function within the wp-includes/general-template.php file.