CVE-2012-0287: WordPress

Low severity, CVSS 2.6. EPSS: 2.5% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected" feature.

Affected products

• WordPress WordPress: version 3.3 only

Published 2012-01-06. Last modified 2026-06-16.