Description
Multiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of WordPress 2.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) website, and (3) comment parameters.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 2.0.2-1 | — |
| Debian 13 | wordpress | 2.0.2-1 | — |
| Debian 12 | wordpress | 2.0.2-1 | — |
References
- wordpress-wpcommentspost-xss(24957) vdb-entry
- http://NeoSecurityTeam.net/advisories/Advisory-17.txt
- 19050 third-party-advisory
- 20060227 WordPress 2.0.1 Multiple Vulnerabilities mailing-list
- ADV-2006-0777 vdb-entry
- 20060302 Re: FW: WordPress 2.0.1 Multiple Vulnerabilities mailing-list
- 20060228 FW: WordPress 2.0.1 Multiple Vulnerabilities mailing-list