$ cve CVE-2004-1559 JSON

CVE-2004-1559 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 6.5% (pctl 94)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or popuptitle parameters to wp-login.php, (2) redirect_url parameter to admin-header.php, (3) popuptitle, popupurl, content, or post_title parameters to bookmarklet.php, (4) cat_ID parameter to categories.php, (5) s parameter to edit.php, or (6) s or mode parameter to edit-comments.php.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	6.47% — more likely to be exploited than 94% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2004-12-31
Last modified	2026-06-16

Affected (1)

Vendor	Product
wordpress	wordpress

Public exploits

Source	Title	Date
exploit-db	WordPress Core 1.2 - 'wp-login.php' Multiple Cross-Site Scripting Vulnerabilities	2004-09-28
exploit-db	WordPress Core 1.2 - 'admin-header.php?redirect_url' Cross-Site Scripting	2004-09-28
exploit-db	WordPress Core 1.2 - 'bookmarklet.php' Multiple Cross-Site Scripting Vulnerabilities	2004-09-28
exploit-db	WordPress Core 1.2 - 'categories.php?cat_ID' Cross-Site Scripting	2004-09-28
exploit-db	WordPress Core 1.2 - 'edit.php?s' Cross-Site Scripting	2004-09-28
exploit-db	WordPress Core 1.2 - 'edit-comments.php' Multiple Cross-Site Scripting Vulnerabilities	2004-09-28

References

→ the Explorer · watch your stack · NVD