Description
Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or popuptitle parameters to wp-login.php, (2) redirect_url parameter to admin-header.php, (3) popuptitle, popupurl, content, or post_title parameters to bookmarklet.php, (4) cat_ID parameter to categories.php, (5) s parameter to edit.php, or (6) s or mode parameter to edit-comments.php.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 1.2.2-1.1 | — |
| Debian 13 | wordpress | 1.2.2-1.1 | — |
| Debian 12 | wordpress | 1.2.2-1.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 6
- WordPress Core 1.2 - 'wp-login.php' Multiple Cross-Site Scripting Vulnerabilities EDB-24641 · webapps · Sep 28, 2004 · verified
- WordPress Core 1.2 - 'admin-header.php?redirect_url' Cross-Site Scripting EDB-24642 · webapps · Sep 28, 2004 · verified
- WordPress Core 1.2 - 'bookmarklet.php' Multiple Cross-Site Scripting Vulnerabilities EDB-24643 · webapps · Sep 28, 2004 · verified
- WordPress Core 1.2 - 'categories.php?cat_ID' Cross-Site Scripting EDB-24644 · webapps · Sep 28, 2004 · verified
- WordPress Core 1.2 - 'edit.php?s' Cross-Site Scripting EDB-24645 · webapps · Sep 28, 2004 · verified
- WordPress Core 1.2 - 'edit-comments.php' Multiple Cross-Site Scripting Vulnerabilities EDB-24646 · webapps · Sep 28, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- wordpress-multiple-scripts-xss(17532) vdb-entry
- 12683 third-party-advisory
- 20040927 Multiple XSS Vulnerabilities in Wordpress 1.2 mailing-list
- 11268 vdb-entry
- 1011440 vdb-entry