Detections
Analytics
WordPress < 1.5.1 Multiple XSS and SQL Injection Vulnerabilities
critical Nessus Plugin ID 16023
Language:
Synopsis
The remote web server contains multiple PHP scripts that are affected by SQL injection and cross-site scripting attacks.Description
According to its banner, the remote version of WordPress is vulnerable to a cross-site scripting attack that may allow an attacker to use the remote server to steal the cookies of third-party users on the remote site.In addition, the remote version of this software is vulnerable to a SQL injection attack that may allow an attacker to manipulate database queries.
Solution
Upgrade to WordPress version 1.5.1 or later.See Also
Plugin Details
Severity: Critical
ID: 16023
File Name: wordpress_xss_sql.nasl
Version: 1.26
Type: remote
Family: CGI abuses
Published: 12/21/2004
Updated: 6/5/2024
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: High
Score: 7.3
CVSS v2
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P
CVSS v3
Risk Factor: Critical
Base Score: 9.9
Temporal Score: 9.5
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:wordpress:wordpress
Required KB Items: www/PHP, installed_sw/WordPress, Settings/ParanoidReport
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Vulnerability Publication Date: 9/27/2004
Reference Information
CVE: CVE-2004-1559
BID: 12066