CVE-2007-1732

LowCVSS 3.5/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: another researcher disputes this issue, stating that this is legitimate functionality for administrators. However, it has been patched by at least one vendor

Metrics

CVSS 2.0 3.5/10AV:N/AC:M/Au:S/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://codex.wordpress.org/Roles_and_CapabilitiesProduct
http://marc.info/?l=bugtraq&m=117319839710382&w=2Mailing List
http://osvdb.org/33884Broken Link
http://secunia.com/advisories/24430Permissions Required, Third Party Advisory
http://secunia.com/advisories/24566Permissions Required, Third Party Advisory
http://www.gentoo.org/security/en/glsa/glsa-200703-23.xmlThird Party Advisory
http://codex.wordpress.org/Roles_and_CapabilitiesProduct
http://marc.info/?l=bugtraq&m=117319839710382&w=2Mailing List
http://osvdb.org/33884Broken Link
http://secunia.com/advisories/24430Permissions Required, Third Party Advisory
http://secunia.com/advisories/24566Permissions Required, Third Party Advisory
http://www.gentoo.org/security/en/glsa/glsa-200703-23.xmlThird Party Advisory

Timeline

Published: Mar 28, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-173310.0Buffer overflow in InterVations NaviCOPA HTTP Server 2.01 allows remote attackers to execute arbitrary code via a long (1) /cgi-bin/ or (2) CVE-2007-17347.2The DCCP support in the do_dccp_getsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later does not verify the upper bounds of CVE-2007-17359.3Stack-based buffer overflow in Corel WordPerfect Office X3 (13.0.0.565) allows user-assisted remote attackers to execute arbitrary code via CVE-2007-17367.5Mozilla Firefox 2.0.0.3 does not check URLs embedded in (1) object or (2) iframe HTML tags against the phishing site blacklist, which allows CVE-2007-17377.5Opera 9.10 does not check URLs embedded in (1) object or (2) iframe HTML tags against the phishing site blacklist, which allows remote attac CVE-2007-17386.9TrueCrypt 4.3, when installed setuid root, allows local users to cause a denial of service (filesystem unavailability) or gain privileges by CVE-2007-17397.8Heap-based buffer overflow in the LDAP server in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to cause a d CVE-2007-17416.2Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation, and their usage, allow local u CVE-2007-17423.7suexec in Apache HTTP Server (httpd) 2.2.3 uses a partial comparison for verifying whether the current directory is within the document root CVE-2007-17434.4suexec in Apache HTTP Server (httpd) 2.2.3 does not verify combinations of user and group IDs on the command line, which might allow local u CVE-2007-17446.3Directory traversal vulnerability in the Shared Folders feature for VMware Workstation before 5.5.4, when a folder is shared, allows users o CVE-2007-17457.1The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks file descriptors, which has unkno