Description
Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: another researcher disputes this issue, stating that this is legitimate functionality for administrators. However, it has been patched by at least one vendor
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 2.1.3-1 | — |
| Debian 13 | wordpress | 2.1.3-1 | — |
| Debian 12 | wordpress | 2.1.3-1 | — |
References
- http://codex.wordpress.org/Roles_and_Capabilities
- 33884 vdb-entry
- 24566 third-party-advisory
- 24430 third-party-advisory
- GLSA-200703-23 vendor-advisory
- 20070306 Re: Wordpress <= v2.1.0 mailing-list