WordPress is "a state-of-the-art semantic personal publishing platform with a focus on aesthetics, web standards, and usability". A vulnerability in WordPress's templates.php allows a user with access to the templates.php to insert arbitrary HTML and/or Javascript which can be then executed by other administrators.
Vulnerable Systems:
* WordPress version 2.0.5 and prior
Immune Systems:
* WordPress version 2.0.6
When editing files a shortcut is created titled recently accessed files . The anchor tag text is correctly escaped with wp_specialchars(); however, the link title is not sanitized. Instead, it is passed to get_file_description($file). The only restriction or limitation here is that our text is passed through basename. This means standard script tags will fail when ending with / . We can get around this by using open IMG tags; this works under FF and IE.
