{"id":"CVE-2013-2201","aliases":["DEBIAN-CVE-2013-2201","DSA-2718-1","EUVD-2013-2156","GHSA-8rr8-9498-4v45","MGASA-2013-0198"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote...","description":"Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5) installation of themes, or (6) updates to themes.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02114,"percentile":0.81926,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2013-07-01T00:00:00Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"Debian:12","package":"wordpress","fixed_in":["3.5.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wordpress","fixed_in":["3.5.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["3.5.2+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2+dfsg-1~deb6u1"}]}],"versions":["3.0.4+dfsg-1","3.0.5+dfsg-0+squeeze1","3.0.5+dfsg-1","3.2.1+dfsg-1","3.2.1+dfsg-2","3.2.1+dfsg-3","3.3+dfsg-1","3.3.1+dfsg-1","3.3.2+dfsg-1","3.3.2+dfsg-1~squeeze1","3.4+dfsg-1","3.4+dfsg-2","3.4+dfsg-3","3.4.1+dfsg-1","3.4.2+dfsg-1","3.5+dfsg-1","3.5.1+dfsg-1","3.5.1+dfsg-2"],"bundled":8},{"source":"osv","ecosystem":"Debian:7","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2+dfsg-1~deb7u1"}]}],"versions":["3.5.1+dfsg-2","3.5.2+dfsg-1~deb6u1"],"bundled":8},{"source":"osv","ecosystem":"Mageia:2","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-1.mga2"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:3","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-1.mga3"}]}],"bundled":8}],"products":[{"vendor":"wordpress","product":"wordpress"}],"references":[{"url":"http://wordpress.org/news/2013/06/wordpress-3-5-2/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.debian.org/security/2013/dsa-2718","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=976784","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://codex.wordpress.org/Version_3.5.2","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2201"},{"url":"http://wordpress.org/news/2013/06/wordpress-3-5-2"},{"url":"https://github.com/advisories/GHSA-8rr8-9498-4v45"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2201","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0198.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=973254","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-2201","description":"Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5) installation of themes, or (6) updates to themes.","status":"published","published":"2013-07-08T20:00:00Z","modified":"2024-08-06T15:27:41.142Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-2156","description":"Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5) installation of themes, or (6) updates to themes.","status":"published","published":"2013-07-08T20:00:00Z","modified":"2024-08-06T15:27:41Z","updated_at":"2026-11-03T01:56:39.164386Z"}],"ghsa":[{"id":"GHSA-8rr8-9498-4v45","title":"Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote...","description":"Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5) installation of themes, or (6) updates to themes.","status":"published","published":"2022-05-17T05:04:54Z","modified":"2025-04-11T04:12:49Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:01:14.490744Z"}],"nvd":[{"id":"CVE-2013-2201","description":"Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5) installation of themes, or (6) updates to themes.","status":"published","published":"2013-07-08T20:55:01.057Z","modified":"2026-06-16T23:52:56.047Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:29.210317Z"}],"osv":[{"id":"CVE-2013-2201","description":"Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5) installation of themes, or (6) updates to themes.","status":"published","published":"2013-07-08T20:55:01Z","modified":"2026-04-16T06:23:08.225312431Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2201","description":"Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5) installation of themes, or (6) updates to themes.","status":"published","published":"2013-07-08T20:55:01.057Z","modified":"2026-09-01T20:03:15.631053103Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DSA-2718-1","title":"wordpress - several","status":"published","published":"2013-07-01T00:00:00Z","modified":"2026-03-09T01:23:26.8581Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0198","title":"Updated wordpress package fixes security vulnerabilities","description":"A denial of service flaw was found in the way Wordpress, a blog tool and\npublishing platform, performed hash computation when checking password for\npassword protected blog posts. A remote attacker could provide a specially-\ncrafted input that, when processed by the password checking mechanism of\nWordpress would lead to excessive CPU consumption (CVE-2013-2173).\n\nInadequate SSRF protection for HTTP requests where the user can provide a\nURL can allow for attacks against the intranet and other sites. This is a\ncontinuation of work related to CVE-2013-0235, which was specific to SSRF\nin pingback requests and was fixed in 3.5.1 (CVE-2013-2199).\n\nInadequate checking of a user's capabilities could allow them to publish\nposts when their user role should not allow for it; and to assign posts to\nother authors (CVE-2013-2200).\n\nInadequate escaping allowed an administrator to trigger a cross-site\nscripting vulnerability through the uploading of media files and plugins\n(CVE-2013-2201).\n\nThe processing of an oEmbed response is vulnerable to an XXE\n(CVE-2013-2202).\n\nIf the uploads directory is not writable, error message data returned via\nXHR will include a full path to the directory (CVE-2013-2203).\n\nContent Spoofing in the MoxieCode (TinyMCE) MoxiePlayer project\n(CVE-2013-2204).\n\nCross-domain XSS in SWFUpload (CVE-2013-2205).\n","status":"published","published":"2013-07-01T19:19:24Z","modified":"2026-04-16T06:22:21.597314894Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}