Unrated severityNVD Advisory· Published Sep 14, 2007· Updated Apr 23, 2026
CVE-2007-4893
CVE-2007-4893
Description
wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_html privilege, which allows remote attackers to conduct cross-site scripting (XSS) attacks via modified data to (1) post.php or (2) page.php with a no_filter field.
Affected products
31cpe:2.3:a:wordpress:wordpress:0.6.2:*:*:*:*:*:*:*+ 30 more
- cpe:2.3:a:wordpress:wordpress:0.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:0.6.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:0.7:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:0.71:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:1.5:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:1.5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:1.5.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.0.10_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.0.10_rc2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.1.3_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.1.3_rc2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.2_revision5002:*:*:*:*:*:*:*
- cpe:2.3:a:wordpress:wordpress:2.2_revision5003:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
9- secunia.com/advisories/26771nvdVendor Advisory
- fedoranews.org/updates/FEDORA-2007-214.shtmlnvd
- secunia.com/advisories/26796nvd
- trac.wordpress.org/ticket/4720nvd
- wordpress.org/development/2007/09/wordpress-223/nvd
- www.securityfocus.com/bid/25639nvd
- www.vupen.com/english/advisories/2007/3132nvd
- bugzilla.redhat.com/show_bug.cginvd
- exchange.xforce.ibmcloud.com/vulnerabilities/36576nvd
News mentions
0No linked articles in our index yet.