A vulnerability has been identified in WordPress, which could be exploited by attackers to execute arbitrary scripting code. This issue is due to an input validation error in the "wp_explain_nonce()" [wp-includes/functions.php] function when processing user-supplied parameters (e.g. the "file" parameter to "wp-admin/templates.php"), which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected Web site.
