CVE-2007-4893

wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_html privilege, which allows remote attackers to conduct cross-site scripting (XSS) attacks via modified data to (1) post.php or (2) page.php with a no_filter field.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

1.52% chance of exploitation in the next 30 days, 73th percentile

Nuclei

medium

Published

2007-09-14

Updated

2024-08-07

Nuclei templates (1)

• topscoder/nuclei-wordfence-cve/blob/main/nuclei-templates/2007/CVE-2007-4893-wpmu-26daa36…

References

• CVE Record
• NVD entry

Related

• CVE-2007-4892
• CVE-2007-4894
• CVE-2007-4891
• CVE-2007-4895
• CVE-2007-4890
• CVE-2007-4896