CVE-2012-2403

no score yetEPSS 2.9%

wordpress wordpress: no CVSS score yet. EPSS 2.9% chance of exploitation in the next 30 days.

wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

EPSS: 2.9% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2012-04-21
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

wordpress:wordpress

References

http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/capabilities.php
http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/formatting.php
http://osvdb.org/81463
http://secunia.com/advisories/48957
http://secunia.com/advisories/49138

Check your stack JSON