CVE-2007-1622

Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATH_INFO in the administration interface, related to loose regular expression processing of PHP_SELF.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

5.78% chance of exploitation in the next 30 days, 93th percentile

Nuclei

low

Published

2007-03-23

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.buayacorp.com/files/wordpress/wordpress-advisory.txt

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2007/CVE-2007-1622-wordpress-a6…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/29754

References

• CVE Record
• NVD entry

Related

• CVE-2007-1621
• CVE-2007-1626
• CVE-2007-1620
• CVE-2007-1628
• CVE-2007-1619
• CVE-2007-1629