Word­Press < = 1.5.1.3 is vul­ner­able to a server-side XSS attack. It requires register\_globals
to be turned on. If you can’t dis­able regis­tra­tion of global vari­ables you might want to enable safe\_mode or dis­able some of the unsafe func­tions by adding

disable_functions = exec, system, passthru

to your php.ini.

Found on fh’s blog