CVE-2007-4153: XSS

Published Aug 3, 2007

Updated

Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the Options Database Table in the Admin Panel, accessed through options.php; or (2) the opmlurl parameter to link-import.php. NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfilteredhtml capability.

Affected Software

1 affected component

WordPress=2.2.1

Event History

Aug 3, 2007

CVE Published

08:17 PM

Aug 4, 2007

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4153?

CVE-2007-4153 is classified as a high severity vulnerability due to its potential for remote code execution through XSS attacks.

How do I fix CVE-2007-4153?

To fix CVE-2007-4153, upgrade WordPress from version 2.2.1 to a later version that has patched the identified XSS vulnerabilities.

Who is affected by CVE-2007-4153?

CVE-2007-4153 affects remote authenticated administrators using WordPress version 2.2.1.

What type of attack is associated with CVE-2007-4153?

CVE-2007-4153 is associated with cross-site scripting (XSS) attacks that can lead to the injection of arbitrary web script or HTML.

Is there a workaround for CVE-2007-4153?

There are no known workarounds for CVE-2007-4153 other than to upgrade to a secure version of WordPress.