Cross-site Scripting Vulnerability in Blix Themes for WordPress
CVE-2007-4481

Currently unrated

Key Information:

Vendor
Wordpress
Status
Blix
Vendor
CVE Published:
22 August 2007

Summary

A cross-site scripting vulnerability exists in the index.php file of the Blix themes (versions 0.9.1 and 0.9.1 Rus) for WordPress. This flaw allows remote attackers to inject arbitrary web scripts or HTML into user browsers by manipulating the PATH_INFO variable, specifically through the PHP_SELF variable. If exploited, this vulnerability can lead to unauthorized actions on behalf of users visiting affected sites, as their browsers may execute the injected scripts.

References

http://websecurity.com.ua/1248/
x_refsource_MISC
http://www.securityfocus.com/archive/1/477253/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://securityvulns.ru/Rdocument825.html
x_refsource_MISC

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.