CVE-2007-1049: WordPress

Medium severity, CVSS 4.3. EPSS: 6.5% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable.

Affected products

• WordPress WordPress: version 0.6.2 only; version 0.6.2.1 only; version 0.7 only; version 0.71 only; version 1.2.2 only; version 1.5 only; …

Published 2007-02-21. Last modified 2026-06-16.