CVE-2007-3238: XSS

Published Jun 15, 2007

Updated

Cross-site scripting (XSS) vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the PATHINFO (REQUESTURI) to wp-admin/themes.php, a different vulnerability than CVE-2007-1622. NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfilteredhtml capability.

Affected Software

1 affected component

WordPress=2.2

Event History

Jun 15, 2007

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-3238?

CVE-2007-3238 is considered a medium severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2007-3238?

To fix CVE-2007-3238, upgrade WordPress to a version later than 2.2 that addresses this vulnerability.

Who is affected by CVE-2007-3238?

CVE-2007-3238 affects WordPress version 2.2, particularly remote authenticated administrators.

What type of vulnerability is CVE-2007-3238?

CVE-2007-3238 is a cross-site scripting (XSS) vulnerability.

What components are involved in CVE-2007-3238?

CVE-2007-3238 involves the functions.php file in the default theme of WordPress.