Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.5
CVE-2009-3891: WordPress lets logged-in users embed malicious code
CVE-2009-3891 · published 16 years ago
Summary
The editing screen in WordPress’s admin area could be tricked by a signed‑in user to insert harmful script or HTML. That code would run in the browsers of anyone who views the affected page, potentially stealing data or taking unwanted actions. Update WordPress to version 2.8.6 or newer, or apply the latest security patch, to stop the problem.
What to do
- Update debian wordpress to version 2.8.6-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | wordpress |
< 2.8.6-1 Fix: upgrade to 2.8.6-1
|
| Debian:13 | debian | wordpress |
< 2.8.6-1 Fix: upgrade to 2.8.6-1
|
| Debian:14 | debian | wordpress |
< 2.8.6-1 Fix: upgrade to 2.8.6-1
|
| – | wordpress | wordpress |
<= 2.8.5 cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
Original advisory text
Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter (aka the s...
Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter (aka the selection variable).
References
- https://security-tracker.debian.org/tracker/CVE-2009-3891 Vendor Advisory
- http://core.trac.wordpress.org/attachment/ticket/11119/press-this-xss-bug-11-10-... Patch Vendor Advisory
- http://core.trac.wordpress.org/attachment/ticket/11119/press-this.002.diff Patch Vendor Advisory
- http://core.trac.wordpress.org/ticket/11119 Vendor Advisory
- http://secunia.com/advisories/37332 Third Party Advisory
- http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/ Patch Vendor Advisory
- http://www.openwall.com/lists/oss-security/2009/11/15/2 Mailing List Third Party Advisory
- http://www.openwall.com/lists/oss-security/2009/11/15/3 Mailing List Third Party Advisory
- http://www.openwall.com/lists/oss-security/2009/11/16/1 Mailing List Third Party Advisory
- http://www.osvdb.org/59959 Broken Link
Severity
3.5
Low
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published17 Nov 2009
Updated31 Oct 2026
First seen17 Sep 2026
Track software like this
Free during beta