Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-xsz3-bme6-ubfn
Vulnerability ID VCID-xsz3-bme6-ubfn
Aliases CVE-2009-2851
Summary WordPress: XSS via unescaped HTML URLs as author comments in the admin page
Status Published
Exploitability 2.0
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
epss 0.02987 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02987 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02987 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02987 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02987 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02987 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02987 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02987 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
epss 0.02987 https://api.first.org/data/v1/epss?cve=CVE-2009-2851
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-2851.json
https://api.first.org/data/v1/epss?cve=CVE-2009-2851
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2851
512900 https://bugzilla.redhat.com/show_bug.cgi?id=512900
CVE-2009-2851;OSVDB-56193 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/9250.sh
Data source Exploit-DB
Date added July 23, 2009
Description WordPress Core 2.8.1 - 'url' Cross-Site Scripting
Ransomware campaign use Known
Source publication date July 24, 2009
Exploit type webapps
Platform php
Source update date May 4, 2017
There are no known vectors.
Exploit Prediction Scoring System (EPSS)
Percentile 0.86477
EPSS Score 0.02987
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T14:58:30.017763+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-2851.json 38.0.0