UpHeron
All vulnerabilities

WordPress core

CVE-2011-4899

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query.…

Severity
High 7.5
Published
30 Jan 2012
Last changed
3 Nov 2026
Added to UpHeron
17 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
WordPressWordPress core · cpe:a:wordpress:wordpress
  • Version 3.3
  • Version 3.2.1
  • Version 3.1.4
  • Version 3.1.3
All 73 release lines
  • Every version up to 3.3.1
  • Version 0.7
  • Version 0.71
  • Version 0.72
  • Version 0.711
  • Version 1.0
  • Version 1.0.1
  • Version 1.0.2
  • Version 1.2
  • Version 1.2.1
  • Version 1.2.2
  • Version 1.5
  • Version 1.5.1
  • Version 1.5.1.2
  • Version 1.5.1.3
  • Version 1.5.2
  • Version 2.0
  • Version 2.0.1
  • Version 2.0.2
  • Version 2.0.3
  • Version 2.0.4
  • Version 2.0.5
  • Version 2.0.6
  • Version 2.0.7
  • Version 2.0.8
  • Version 2.0.9
  • Version 2.0.10
  • Version 2.0.11
  • Version 2.1
  • Version 2.1.1
  • Version 2.1.2
  • Version 2.1.3
  • Version 2.2
  • Version 2.2.1
  • Version 2.2.2
  • Version 2.2.3
  • Version 2.3
  • Version 2.3.1
  • Version 2.3.2
  • Version 2.3.3
  • Version 2.5
  • Version 2.5.1
  • Version 2.6
  • Version 2.6.1
  • Version 2.6.2
  • Version 2.6.3
  • Version 2.6.5
  • Version 2.7
  • Version 2.7.1
  • Version 2.8
  • Version 2.8.1
  • Version 2.8.2
  • Version 2.8.3
  • Version 2.8.4
  • Version 2.8.5
  • Version 2.8.6
  • Version 2.9
  • Version 2.9.1
  • Version 2.9.2
  • Version 3.0
  • Version 3.0.1
  • Version 3.0.2
  • Version 3.0.3
  • Version 3.0.4
  • Version 3.0.5
  • Version 3.0.6
  • Version 3.1
  • Version 3.1.1
  • Version 3.1.2
  • Version 3.1.3
  • Version 3.1.4
  • Version 3.2.1
  • Version 3.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2011-4899
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2011-4899