{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-07-26T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, one of which involves an rss2 feed with an invalid or missing blog with an XSS sequence in the query string."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "20070726 WordPress wp-feedstats persistent XSS", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://marc.info/?l=full-disclosure&m=118548811323718&w=2"}, {"name": "25085", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/25085"}, {"tags": ["x_refsource_MISC"], "url": "http://blogsecurity.net/wordpress/news-260707/"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bueltge.de/plugin-wp-feedstats-in-neuer-version/481/"}, {"name": "37259", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/37259"}, {"name": "26249", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/26249"}, {"name": "wordpress-wpfeedstats-xss(35646)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35646"}, {"tags": ["x_refsource_MISC"], "url": "http://blogsecurity.net/news/news-130707/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-4104", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, one of which involves an rss2 feed with an invalid or missing blog with an XSS sequence in the query string."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "20070726 WordPress wp-feedstats persistent XSS", "refsource": "FULLDISC", "url": "http://marc.info/?l=full-disclosure&m=118548811323718&w=2"}, {"name": "25085", "refsource": "BID", "url": "http://www.securityfocus.com/bid/25085"}, {"name": "http://blogsecurity.net/wordpress/news-260707/", "refsource": "MISC", "url": "http://blogsecurity.net/wordpress/news-260707/"}, {"name": "http://bueltge.de/plugin-wp-feedstats-in-neuer-version/481/", "refsource": "CONFIRM", "url": "http://bueltge.de/plugin-wp-feedstats-in-neuer-version/481/"}, {"name": "37259", "refsource": "OSVDB", "url": "http://osvdb.org/37259"}, {"name": "26249", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/26249"}, {"name": "wordpress-wpfeedstats-xss(35646)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35646"}, {"name": "http://blogsecurity.net/news/news-130707/", "refsource": "MISC", "url": "http://blogsecurity.net/news/news-130707/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T14:46:38.609Z"}, "title": "CVE Program Container", "references": [{"name": "20070726 WordPress wp-feedstats persistent XSS", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://marc.info/?l=full-disclosure&m=118548811323718&w=2"}, {"name": "25085", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/25085"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://blogsecurity.net/wordpress/news-260707/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bueltge.de/plugin-wp-feedstats-in-neuer-version/481/"}, {"name": "37259", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/37259"}, {"name": "26249", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/26249"}, {"name": "wordpress-wpfeedstats-xss(35646)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35646"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://blogsecurity.net/news/news-130707/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-4104", "datePublished": "2007-07-31T10:00:00", "dateReserved": "2007-07-31T00:00:00", "dateUpdated": "2024-08-07T14:46:38.609Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wp-feedstats:wordpress_plugin:*:*:*:*:*:*:*:*", "matchCriteriaId": "80E09F20-0427-4706-89B4-CD0B1BD65859", "versionEndIncluding": "2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the WP-FeedStats before 2.4 plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, one of which involves an rss2 feed with an invalid or missing blog with an XSS sequence in the query string."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en la extensi\u00f3n WP-FeedStats anterior a 2.4 para WordPress permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de vectores no especificados, uno de los cuales involucra una fuente rss2 con un blog inv\u00e1lido o ausente con una secuencia XSS en la cadena de b\u00fasqueda."}], "id": "CVE-2007-4104", "lastModified": "2017-07-29T01:32:43.130", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-07-31T10:17:00.000", "references": [{"source": "cve@mitre.org", "url": "http://blogsecurity.net/news/news-130707/"}, {"source": "cve@mitre.org", "url": "http://blogsecurity.net/wordpress/news-260707/"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://bueltge.de/plugin-wp-feedstats-in-neuer-version/481/"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://marc.info/?l=full-disclosure&m=118548811323718&w=2"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/37259"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/26249"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch"], "url": "http://www.securityfocus.com/bid/25085"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35646"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}