CVE-2007-4893

no score yetEPSS 1.5%

wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_html privilege, which allows remote attackers to conduct cross-site scripting (XSS) attacks via modified data to (1) post.php or (2) page.php with a no_filter field.

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2007-09-14
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

wordpress:wordpress

References

http://fedoranews.org/updates/FEDORA-2007-214.shtml
http://secunia.com/advisories/26771
http://secunia.com/advisories/26796
http://trac.wordpress.org/ticket/4720
http://wordpress.org/development/2007/09/wordpress-223/

Check your stack JSON