CVE-2012-1834: Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tre...

Security readout for executives and security teams

CVE-2012-1834 is a cross-site scripting issue in the WordPress CMS Tree Page View plugin before 0.8.9. A malicious request could inject script or HTML through an admin-page parameter. Business risk depends on whether exposed sites still run this old plugin and who can reach the affected admin page. Exposure is likely limited to WordPress installations using CMS Tree Page View versions before 0.8.9. The affected path is under wp-admin, so validate role and authentication requirements in the deployed environment rather than assuming broad public reach. Treat this as a targeted cleanup item, not an emergency based on current evidence. Patch or remove the plugin on any production WordPress site, especially where administrators use shared browsers or where admin access is broadly reachable. Mitigation focus: Upgrade CMS Tree Page View to version 0.8.9 or later if still installed.; Remove the plugin if it is unused or no longer maintained.; Restrict WordPress admin access to trusted users and networks where feasible..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.