WordPress CVE-2013-2201 Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	60770
Class:	Input Validation Error
CVE:	CVE-2013-2201
Remote:	Yes
Local:	No
Published:	Jun 21 2013 12:00AM
Updated:	May 07 2015 05:04PM
Credit:	Andrea Santese and Rodrigo
Vulnerable:	WordPress WordPress 3.3.2 WordPress WordPress 3.2.2 WordPress WordPress 3.1.4 WordPress WordPress 3.1.3 WordPress WordPress 3.1.2 WordPress WordPress 3.1.1 WordPress WordPress 3.0.5 WordPress WordPress 3.0.4 WordPress WordPress 3.0.2 WordPress WordPress 3.3.1 WordPress WordPress 3.3 WordPress WordPress 3.1 WordPress WordPress 3.0.6 WordPress WordPress 3.0.3 WordPress WordPress 3.0.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

WordPress CVE-2013-2201 Multiple Cross Site Scripting Vulnerabilities

WordPress is prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to WordPress 3.5.2 are vulnerable.

WordPress CVE-2013-2201 Multiple Cross Site Scripting Vulnerabilities

To exploit these issues an attacker must entice an unsuspecting victim to open a malicious URI.

WordPress CVE-2013-2201 Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva wordpress-3.5.2-1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/

WordPress CVE-2013-2201 Multiple Cross Site Scripting Vulnerabilities

References:

• WP-Members Homepage (WordPress)