CVE-2007-0106

Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack with an invalid token and quote characters or HTML tags in URL variable names, which are not properly handled when WordPress generates a new link to verify the request.

• http://osvdb.org/33397
• http://secunia.com/advisories/23595Vendor Advisory
• http://securityreason.com/securityalert/2114
• http://wordpress.org/development/2007/01/wordpress-206/Patch, Vendor Advisory
• http://www.hardened-php.net/advisory_012007.140.htmlVendor Advisory
• http://www.securityfocus.com/archive/1/456048/100/0/threaded
• http://www.securityfocus.com/bid/21893Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2007/0061
• http://osvdb.org/33397
• http://secunia.com/advisories/23595Vendor Advisory
• http://securityreason.com/securityalert/2114
• http://wordpress.org/development/2007/01/wordpress-206/Patch, Vendor Advisory
• http://www.hardened-php.net/advisory_012007.140.htmlVendor Advisory
• http://www.securityfocus.com/archive/1/456048/100/0/threaded
• http://www.securityfocus.com/bid/21893Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2007/0061

Published

Jan 9, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-0100The Perforce client does not restrict the set of files that …
• CVE-2007-0101Cross-site request forgery (CSRF) vulnerability in SPINE all…
• CVE-2007-0102The Adobe PDF specification 1.3, as implemented by Apple Mac…
• CVE-2007-0103The Adobe PDF specification 1.3, as implemented by Adobe Acr…
• CVE-2007-0104The Adobe PDF specification 1.3, as implemented by (a) xpdf …
• CVE-2007-0105Stack-based buffer overflow in the CSAdmin service in Cisco …
• CVE-2007-0107WordPress before 2.0.6, when mbstring is enabled for PHP, de…
• CVE-2007-0108nwgina.dll in Novell Client 4.91 SP3 for Windows 2000/XP/200…
• CVE-2007-0109wp-login.php in WordPress 2.0.5 and earlier displays differe…
• CVE-2007-0110Cross-site scripting (XSS) vulnerability in nidp/idff/sso in…
• CVE-2007-0111Buffer overflow in Resco Photo Viewer for PocketPC 4.11 and …
• CVE-2007-0112SQL injection vulnerability in cats.asp in createauction all…