CVE-2004-1559

Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to...

4.3 MediumPublic exploitFix available

Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or popuptitle parameters to wp-login.php, (2) redirect_url parameter to admin-header.php, (3) popuptitle, popupurl, content, or post_title parameters to bookmarklet.php, (4) cat_ID parameter to categories.php, (5) s parameter to edit.php, or (6) s or mode parameter to edit-comments.php.

Exploit likelihood

6.46%Up 4.5 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2004-1559
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2004-1559
Updated: 2026-11-02

EUVDEUVD-2004-1553 No score

Record: EUVD-2004-1553
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w42r-hrg2-j8mr No score

Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to...

Record: GHSA-w42r-hrg2-j8mr
Updated: 2026-11-02

OSV No score

Record: CVE-2004-1559
Updated: 2026-11-02

OSVDEBIAN-CVE-2004-1559 No score

Record: DEBIAN-CVE-2004-1559
Updated: 2026-11-02

Affected products

wordpress

Affected packages

Affected packages
Package	Affected	Fixed
`wordpress` Debian:12	before 1.2.2-1.1	1.2.2-1.1
`wordpress` Debian:13	before 1.2.2-1.1	1.2.2-1.1
`wordpress` Debian:14	before 1.2.2-1.1	1.2.2-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	WordPress Core 1.2 - 'wp-login.php' Multiple Cross-Site Scripting Vulnerabilities	2004-09-28
Exploit-DB	WordPress Core 1.2 - 'admin-header.php?redirect_url' Cross-Site Scripting	2004-09-28
Exploit-DB	WordPress Core 1.2 - 'bookmarklet.php' Multiple Cross-Site Scripting Vulnerabilities	2004-09-28
Exploit-DB	WordPress Core 1.2 - 'categories.php?cat_ID' Cross-Site Scripting	2004-09-28
Exploit-DB	WordPress Core 1.2 - 'edit.php?s' Cross-Site Scripting	2004-09-28
Exploit-DB	WordPress Core 1.2 - 'edit-comments.php' Multiple Cross-Site Scripting Vulnerabilities	2004-09-28

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2004-1559 is a medium vulnerability (CVSS 4.3) in Wordpress, published December 31, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.46%, the 93rd percentile. Fixed in wordpress 1.2.2-1.1.