CVE-2009-2851

Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via a comment author URL.

• CWE-79

• http://bugs.gentoo.org/show_bug.cgi?id=278492Issue Tracking, Third Party Advisory
• http://securitytracker.com/id?1022589Third Party Advisory, VDB Entry
• http://wordpress.org/development/2009/07/wordpress-2-8-2/Patch, Vendor Advisory
• http://www.debian.org/security/2009/dsa-1871Third Party Advisory
• http://www.openwall.com/lists/oss-security/2009/07/21/1Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=512900Issue Tracking, Third Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01241.htmlMailing List, Third Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01253.htmlMailing List, Third Party Advisory
• http://bugs.gentoo.org/show_bug.cgi?id=278492Issue Tracking, Third Party Advisory
• http://securitytracker.com/id?1022589Third Party Advisory, VDB Entry
• http://wordpress.org/development/2009/07/wordpress-2-8-2/Patch, Vendor Advisory
• http://www.debian.org/security/2009/dsa-1871Third Party Advisory
• http://www.openwall.com/lists/oss-security/2009/07/21/1Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=512900Issue Tracking, Third Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01241.htmlMailing List, Third Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01253.htmlMailing List, Third Party Advisory

Published

Aug 18, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2845Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2009-2846The eisa_eeprom_read function in the parisc isa-eeprom compo…
• CVE-2009-2847The do_sigaltstack function in kernel/signal.c in Linux kern…
• CVE-2009-2848The execve function in the Linux kernel, possibly 2.6.30-rc6…
• CVE-2009-2849The md driver (drivers/md/md.c) in the Linux kernel before 2…
• CVE-2009-2850Multiple buffer overflows in NASA Common Data Format (CDF) a…
• CVE-2009-2852WP-Syntax plugin 0.9.1 and earlier for Wordpress, with regis…
• CVE-2009-2853Wordpress before 2.8.3 allows remote attackers to gain privi…
• CVE-2009-2854Wordpress before 2.8.3 does not check capabilities for certa…
• CVE-2009-2855The strListGetItem function in src/HttpHeaderTools.c in Squi…
• CVE-2009-2856Sun Virtual Desktop Infrastructure (VDI) 3.0, when anonymous…
• CVE-2009-2857The kernel in Sun Solaris 8, 9, and 10, and OpenSolaris befo…5.5