CVE-2007-1732

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-03-28 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: another researcher disputes this issue, stating that this is legitimate functionality for administrators. However, it has been patched by at least one vendor

Affected products

WordPress: 2.1.2

References

http://codex.wordpress.org/Roles_and_Capabilities
http://marc.info/?l=bugtraq&m=117319839710382&w=2
http://osvdb.org/33884
http://secunia.com/advisories/24430
http://secunia.com/advisories/24566
http://www.gentoo.org/security/en/glsa/glsa-200703-23.xml
http://codex.wordpress.org/Roles_and_Capabilities
http://marc.info/?l=bugtraq&m=117319839710382&w=2
http://osvdb.org/33884
http://secunia.com/advisories/24430
http://secunia.com/advisories/24566
http://www.gentoo.org/security/en/glsa/glsa-200703-23.xml

Get alerted when CVE-2007-1732 or the next vulnerability affects your stack