Unrated severityNVD Advisory· Published Aug 3, 2007· Updated Jun 16, 2026
CVE-2007-4139
CVE-2007-4139
Description
Cross-site scripting (XSS) vulnerability in the Temporary Uploads editing functionality (wp-admin/includes/upload.php) in WordPress 2.2.1, allows remote attackers to inject arbitrary web script or HTML via the style parameter to wp-admin/upload.php.
Affected products
2cpe:2.3:a:wordpress:wordpress:2.2.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:wordpress:wordpress:2.2.1:*:*:*:*:*:*:*
- (no CPE)range: = 2.2.1
Patches
Vulnerability mechanics
References
8- mybeni.rootzilla.de/mybeNi/2007/wordpress_zeroday_vulnerability_roundhouse_kick_and_why_i_nearly_wrote_the_first_blog_worm/nvdExploit
- trac.wordpress.org/ticket/4689nvdExploit
- secunia.com/advisories/26296nvdVendor Advisory
- osvdb.org/36621nvd
- trac.wordpress.org/attachment/ticket/4689/4689.diffnvd
- www.securityfocus.com/bid/25158nvd
- www.vupen.com/english/advisories/2007/2744nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/35718nvd
News mentions
0No linked articles in our index yet.