CVE-2007-1622

Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATH_INFO in the administration interface, related to loose regular expression processing of PHP_SELF.

• http://secunia.com/advisories/24567Vendor Advisory
• http://secunia.com/advisories/25108
• http://sla.ckers.org/forum/read.php?2%2C7935#msg-8006
• http://www.buayacorp.com/files/wordpress/wordpress-advisory.txtExploit, Patch, Vendor Advisory
• http://www.debian.org/security/2007/dsa-1285
• http://www.securityfocus.com/bid/23027
• http://www.vupen.com/english/advisories/2007/1005
• http://secunia.com/advisories/24567Vendor Advisory
• http://secunia.com/advisories/25108
• http://sla.ckers.org/forum/read.php?2%2C7935#msg-8006
• http://www.buayacorp.com/files/wordpress/wordpress-advisory.txtExploit, Patch, Vendor Advisory
• http://www.debian.org/security/2007/dsa-1285
• http://www.securityfocus.com/bid/23027
• http://www.vupen.com/english/advisories/2007/1005

Published

Mar 23, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-1616SQL injection vulnerability in index.php in ScriptMagix Lyri…
• CVE-2007-1617SQL injection vulnerability in index.php in ScriptMagix Reci…
• CVE-2007-1618SQL injection vulnerability in index.php in ScriptMagix FAQ …
• CVE-2007-1619SQL injection vulnerability in viewcomments.php in ScriptMag…
• CVE-2007-1620Multiple PHP remote file inclusion vulnerabilities in PHP DB…
• CVE-2007-1621PHP remote file inclusion vulnerability in templates/head.ph…
• CVE-2007-1623Multiple cross-site scripting (XSS) vulnerabilities in realG…
• CVE-2007-1624Multiple SQL injection vulnerabilities in realGuestbook 5.01…
• CVE-2007-1625Cross-site scripting (XSS) vulnerability in save_entry.php i…
• CVE-2007-1626PHP remote file inclusion vulnerability in iframe.php in the…
• CVE-2007-1627Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2007-1628Multiple PHP remote file inclusion vulnerabilities in Study …