Unscored severity · published Mar 20, 2009
CVE-2009-1030
Cross-site scripting (XSS) vulnerability in the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU (WPMU) before 2.7 allows remote attackers to inject…
–
CVSS
4.7%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU (WPMU) before 2.7 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.7% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
Wordpress MU · Wordpress
through 2.6; 1.0; 1.0; 1.0; 1.0; 1.0; +20 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1030
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1030
marc.info
http://marc.info/?l=bugtraq&m=126996727024732&w=2
www.securityfocus.com
http://www.securityfocus.com/archive/1/501667/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/34075
www.securitytracker.com
http://www.securitytracker.com/id?1021838
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/49184
www.exploit-db.com
https://www.exploit-db.com/exploits/8196
More from Wordpress MU
–
CVE-2009-2432
WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an…
–
CVE-2009-2336
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which…
–
CVE-2009-2335
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to…
–
CVE-2009-2334
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers…
–
CVE-2008-5695
wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated…