Search for vulnerabilities
Vulnerability details: VCID-8ehz-ehr4-ffcm
Vulnerability ID VCID-8ehz-ehr4-ffcm
Aliases CVE-2009-2851
Summary WordPress: XSS via unescaped HTML URLs as author comments in the admin page
Status Published
Exploitability 2.0
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02439 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-2851.json
https://api.first.org/data/v1/epss?cve=CVE-2009-2851
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2851
512900 https://bugzilla.redhat.com/show_bug.cgi?id=512900
CVE-2009-2851;OSVDB-56193 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/9250.sh
Data source Exploit-DB
Date added July 23, 2009
Description WordPress Core 2.8.1 - 'url' Cross-Site Scripting
Ransomware campaign use Known
Source publication date July 24, 2009
Exploit type webapps
Platform php
Source update date May 4, 2017
There are no known vectors.
Exploit Prediction Scoring System (EPSS)
Percentile 0.84542
EPSS Score 0.02439
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T11:29:02.736410+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-2851.json 37.0.0