CVE-2012-1068

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-02-14 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging.

Affected products

mg12 WP-RecentComments: through 2.0.7; 1.8, 1.8.1, 1.8.2, 2.0, 2.0.1, 2.0.2 (+4)

References

http://plugins.trac.wordpress.org/changeset/416723/wp-recentcomments/trunk/core.php?old=316325&old_path=wp-recentcomments%2Ftrunk%2Fcore.php
http://secunia.com/advisories/46141
http://wordpress.org/extend/plugins/wp-recentcomments/changelog/
http://www.osvdb.org/75635
http://www.securityfocus.com/bid/49734
https://exchange.xforce.ibmcloud.com/vulnerabilities/70003
http://plugins.trac.wordpress.org/changeset/416723/wp-recentcomments/trunk/core.php?old=316325&old_path=wp-recentcomments%2Ftrunk%2Fcore.php
http://secunia.com/advisories/46141
http://wordpress.org/extend/plugins/wp-recentcomments/changelog/
http://www.osvdb.org/75635
http://www.securityfocus.com/bid/49734
https://exchange.xforce.ibmcloud.com/vulnerabilities/70003

Get alerted when CVE-2012-1068 or the next vulnerability affects your stack