WordPress 'wp-includes/feed.php' Cross-Site Scripting Vulnerability

Bugtraq ID:	32476
Class:	Input Validation Error
CVE:	CVE-2008-5278
Remote:	Yes
Local:	No
Published:	Nov 25 2008 12:00AM
Updated:	Apr 13 2015 09:35PM
Credit:	Jeremias Reith
Vulnerable:	WordPress Wordpress (B2) 0.6.2 .1 WordPress WordPress 2.6.2 WordPress WordPress 2.6.1 WordPress WordPress 2.5.1 WordPress WordPress 2.3.3 WordPress WordPress 2.3.2 WordPress WordPress 2.3.1 WordPress WordPress 2.2.3 WordPress WordPress 2.2.2 WordPress WordPress 2.2.1 WordPress WordPress 2.1.3 WordPress WordPress 2.1.2 WordPress WordPress 2.1.1 WordPress WordPress 2.0.11 WordPress WordPress 2.0.10 WordPress WordPress 2.0.7 WordPress WordPress 2.0.6 WordPress WordPress 2.0.5 WordPress WordPress 2.0.4 WordPress WordPress 2.0.3 WordPress WordPress 2.0.2 WordPress WordPress 2.0.1 WordPress WordPress 2.0 WordPress WordPress 1.5.2 WordPress WordPress 1.5.1 .3 WordPress WordPress 1.5.1 .2 WordPress WordPress 1.5.1 WordPress WordPress 1.5 WordPress WordPress 1.3.1 WordPress WordPress 1.2.2 WordPress WordPress 1.2.1 + Gentoo Linux WordPress WordPress 1.2 + Gentoo Linux 1.4 + Gentoo Linux WordPress WordPress 0.71 WordPress WordPress 0.7 WordPress WordPress 2.6 WordPress WordPress 2.5 WordPress WordPress 2.3 WordPress WordPress 2.2 Revision 5003 WordPress WordPress 2.2 Revision 5002 WordPress WordPress 2.2 WordPress WordPress 2.1.3-RC2 WordPress WordPress 2.1.3-RC1 WordPress WordPress 2.1 WordPress WordPress 2.0.10-RC2 WordPress WordPress 2.0.10-RC1
Not Vulnerable:	WordPress WordPress 2.6.5

WordPress 'wp-includes/feed.php' Cross-Site Scripting Vulnerability

WordPress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to WordPress 2.6.5 are vulnerable.

WordPress 'wp-includes/feed.php' Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

WordPress 'wp-includes/feed.php' Cross-Site Scripting Vulnerability

Solution:
The vendor has released WordPress 2.6.5 to address this issue. Please see the references for more information.


WordPress WordPress 2.2

• WordPress latest.tar.gz
  http://wordpress.org/latest.tar.gz

WordPress WordPress 2.3

• WordPress latest.tar.gz
  http://wordpress.org/latest.tar.gz

WordPress 'wp-includes/feed.php' Cross-Site Scripting Vulnerability

References:

• WordPress 2.6.5 (WordPress)
  
• Wordpress church_admin Plugin "id" Cross-Site Scripting Vulnerability (Sammy Forgit)
  
• WordPress XSS vulnerability in RSS Feed Generator (Jeremias Reith )