VULNERABILITY INTELLIGENCE
CVE-2007-4893
CVSS score4.3 MEDIUM
EPSS probability1.52%
CISA KEVNot currently listed
Published2007-09-14
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:N/I:P/A:N
Description
wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_html privilege, which allows remote attackers to conduct cross-site scripting (XSS) attacks via modified data to (1) post.php or (2) page.php with a no_filter field.
Weakness classification
- CWE-352: Cross-Site Request Forgery (CSRF)