Skip to content
Fencer Vulns
medium 4.3

CVE-2004-1559 json

Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the…

published 2004-12-31 21 y ago modified 2026-06-16 4 mo ago also EUVD-2004-1553

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
6.5%
EPSS 6.5% chance of exploitation in 30 days, percentile 93%
public exploits
6
Exploit-DB

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or popuptitle parameters to wp-login.php, (2) redirect_url parameter to admin-header.php, (3) popuptitle, popupurl, content, or post_title parameters to bookmarklet.php, (4) cat_ID parameter to categories.php, (5) s parameter to edit.php, or (6) s or mode parameter to edit-comments.php.

Patch / fix

  • wordpress Debian 14, Debian 13, Debian 12 1.2.2-1.1

debian advisories DEBIAN-CVE-2004-1559

Timeline

  1. First public exploit (EDB-24646)
  2. Published

Exploit prediction

6.46% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-24646 WordPress Core 1.2 - 'edit-comments.php' Multiple Cross-Site Scripting Vulnerabilities webapps, 2004-09-28
  • EDB-24645 WordPress Core 1.2 - 'edit.php?s' Cross-Site Scripting webapps, 2004-09-28
  • EDB-24644 WordPress Core 1.2 - 'categories.php?cat_ID' Cross-Site Scripting webapps, 2004-09-28
  • EDB-24643 WordPress Core 1.2 - 'bookmarklet.php' Multiple Cross-Site Scripting Vulnerabilities webapps, 2004-09-28
  • EDB-24642 WordPress Core 1.2 - 'admin-header.php?redirect_url' Cross-Site Scripting webapps, 2004-09-28
  • EDB-24641 WordPress Core 1.2 - 'wp-login.php' Multiple Cross-Site Scripting Vulnerabilities webapps, 2004-09-28
  • securityfocus.com http://www.securityfocus.com/bid/11268 referenced PoC, tagged "exploit" by a source, unverified
  • secunia.com http://secunia.com/advisories/12683 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.