CVE-2007-4153

NameCVE-2007-4153
DescriptionMultiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the Options Database Table in the Admin Panel, accessed through options.php; or (2) the opml_url parameter to link-import.php. NOTE: this might not cross privilege boundaries in some configurations, since the Administrator role has the unfiltered_html capability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1564-1
NVD severitylow (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
wordpress (PTS)wheezy3.6.1+dfsg-1~deb7u10fixed
wheezy (security)3.6.1+dfsg-1~deb7u12fixed
jessie4.1+dfsg-1+deb8u9fixed
jessie (security)4.1+dfsg-1+deb8u11fixed
stretch4.6.1+dfsg-2fixed
sid4.7+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
wordpresssource(unstable)2.2.2-1low
wordpresssourceetch2.0.10-1etch2lowDSA-1564-1

Notes

see issue 4690 and 4691 in wordpress trac

Search for package or bug name: Reporting problems