CVE-2007-1732

Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: another researcher disputes this issue, stating that this is legitimate functionality for administrators. However, it has been patched by at least one vendor

• CWE-79

• http://codex.wordpress.org/Roles_and_CapabilitiesProduct
• http://marc.info/?l=bugtraq&m=117319839710382&w=2Mailing List
• http://osvdb.org/33884Broken Link
• http://secunia.com/advisories/24430Permissions Required, Third Party Advisory
• http://secunia.com/advisories/24566Permissions Required, Third Party Advisory
• http://www.gentoo.org/security/en/glsa/glsa-200703-23.xmlThird Party Advisory
• http://codex.wordpress.org/Roles_and_CapabilitiesProduct
• http://marc.info/?l=bugtraq&m=117319839710382&w=2Mailing List
• http://osvdb.org/33884Broken Link
• http://secunia.com/advisories/24430Permissions Required, Third Party Advisory
• http://secunia.com/advisories/24566Permissions Required, Third Party Advisory
• http://www.gentoo.org/security/en/glsa/glsa-200703-23.xmlThird Party Advisory

Published

Mar 28, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-1726Unrestricted file upload vulnerability in index.php in IceBB…
• CVE-2007-1727Unspecified vulnerability in HP OpenView Network Node Manage…
• CVE-2007-1728The Remote Play feature in Sony Playstation 3 (PS3) 1.60 and…
• CVE-2007-1729SQL injection vulnerability in includes/start.php in Flexbb …
• CVE-2007-1730Integer signedness error in the DCCP support in the do_dccp_…
• CVE-2007-1731Multiple stack-based buffer overflows in High Performance An…
• CVE-2007-1733Buffer overflow in InterVations NaviCOPA HTTP Server 2.01 al…
• CVE-2007-1734The DCCP support in the do_dccp_getsockopt function in net/d…
• CVE-2007-1735Stack-based buffer overflow in Corel WordPerfect Office X3 (…
• CVE-2007-1736Mozilla Firefox 2.0.0.3 does not check URLs embedded in (1) …
• CVE-2007-1737Opera 9.10 does not check URLs embedded in (1) object or (2)…
• CVE-2007-1738TrueCrypt 4.3, when installed setuid root, allows local user…