Total vulnerabilities in the database
Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.
| Software | From | Fixed in |
|---|---|---|
| WordPress / wordpress | 2.0 | 2.0.x |
| WordPress / wordpress | 2.0.2 | 2.0.2.x |
| WordPress / wordpress | 2.0.6 | 2.0.6.x |
| WordPress / wordpress | 2.0.1 | 2.0.1.x |
| WordPress / wordpress | 2.0.4 | 2.0.4.x |
| WordPress / wordpress | 0.6.2.1-beta_2 | 0.6.2.1-beta_2.x |
| WordPress / wordpress | 0.7 | 0.7.x |
| WordPress / wordpress | 2.0.7 | 2.0.7.x |
| WordPress / wordpress | 0.71 | 0.71.x |
| WordPress / wordpress | 2.0.5 | 2.0.5.x |
| WordPress / wordpress | 1.5.2 | 1.5.2.x |
| WordPress / wordpress | 2.0.3 | 2.0.3.x |
| WordPress / wordpress | 1.5.1.2 | 1.5.1.2.x |
| WordPress / wordpress | 1.2.2 | 1.2.2.x |
| WordPress / wordpress | 1.5 | 1.5.x |
| WordPress / wordpress | 1.5.1 | 1.5.1.x |
| WordPress / wordpress | 0.6.2-beta_2 | 0.6.2-beta_2.x |
| WordPress / wordpress | 1.5.1.3 | 1.5.1.3.x |
| WordPress / wordpress | 1.2 | 1.2.x |
| WordPress / wordpress | 1.2.1 | 1.2.1.x |