WordPress Core <= 2.2.1 - Cross-Site Scripting

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Core <= 2.2.1 - Cross-Site Scripting
6.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE CVE-2007-4139
CVSS 6.4 (Medium)
Publicly Published August 5, 2007
Last Updated December 5, 2022

Description

Cross-site scripting (XSS) vulnerability in the Temporary Uploads editing functionality (wp-admin/includes/upload.php) in WordPress 2.2.1, allows remote attackers to inject arbitrary web script or HTML via the style parameter to wp-admin/upload.php.

Learn more about Cross-Site Scripting vulnerabilities and how to prevent them.

References

Share

Vulnerability Details for WordPress

WordPress

Software Type Core
Patched? Yes
Remediation Update to one of the following versions, or a newer patched version: 2.0.11, 2.2.2
Affected Versions
  • <= 2.0.10
  • 2.2 - 2.2.1
Patched Versions
  • 2.0.11
  • 2.2.2

Recent vulnerabilities in WordPress

WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed
6.4
CVE ID Unknown
Oct 7, 2026
Researchers: Zhengyu Liu, Jingcheng Yang, Gavin Zhong
WordPress Core 4.7.0 - 7.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API
4.3
CVE ID Unknown
Oct 7, 2026
Researcher: Anthropic
WordPress Core 4.7.0 - 7.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds
5.3
CVE-2026-66666
Oct 7, 2026
Researcher: Ananda Dhakal
WordPress Core 6.5.0 - 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export
4.8
CVE ID Unknown
Oct 7, 2026
Researcher: Anthropic
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
3.3
CVE ID Unknown
Oct 7, 2026
Researcher: Alex Concha
WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details
4.3
CVE ID Unknown
Oct 7, 2026
Researcher: Anthropic
WordPress Core 7.1 - 7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments
7.2
CVE ID Unknown
Oct 6, 2026
Researcher: Thomas Chauchefoin
WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal
8.1
CVE-2026-87902
Sep 22, 2026
Researcher: Robert Ressl
WordPress Core <= 7.1 - Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API
4.3
CVE ID Unknown
Sep 17, 2026
Researcher: viridis
WordPress Core <= 7.1 - Forced Theme Install/Preview and Selector Injection via Theme Installer Route
4.3
CVE ID Unknown
Sep 17, 2026
Researcher: Paulos Yibelo
# Title CVE ID CVSS Researchers Date
1 WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed 6.4 Zhengyu Liu, Jingcheng Yang, Gavin Zhong October 7, 2026
2 WordPress Core 4.7.0 - 7.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API 4.3 Anthropic October 7, 2026
3 WordPress Core 4.7.0 - 7.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds CVE-2026-66666 5.3 Ananda Dhakal October 7, 2026
4 WordPress Core 6.5.0 - 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export 4.8 Anthropic October 7, 2026
5 WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type 3.3 Alex Concha October 7, 2026
6 WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details 4.3 Anthropic October 7, 2026
7 WordPress Core 7.1 - 7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments 7.2 Thomas Chauchefoin October 6, 2026
8 WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal CVE-2026-87902 8.1 Robert Ressl September 22, 2026
9 WordPress Core <= 7.1 - Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API 4.3 viridis September 17, 2026
10 WordPress Core <= 7.1 - Forced Theme Install/Preview and Selector Injection via Theme Installer Route 4.3 Paulos Yibelo September 17, 2026
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation