Upgrading WordPress and old bug issue

After a long time using 2.0.5, finally, i decided to upgrade to 2.2 (latest stable released on May 15, 2007). Nothing changes if you look from the cover (themes), but as an admin or registered user you’ll see a new stylish login box at wp-login and some changed options in administration page. Actually, holly things are changed inside (scripts). It was easy to upgrade to 2.2, just follow instructions available on wp documentation’s page, section Upgrading WordPress. I felt glad that all plugins i’ve used before still work in 2.2. There are some reasons why i do upgrading to 2.2, but mostly comes from bug issue. Whilst googling to search vulners in old wp, i found some interesting sites which share exploit to compromise with wp (For your convenience please see wp trac). Here they are :

• WordPress 2.2 (xmlrpc.php) Remote SQL Injection Exploit by Alexander Concha. Actually I’ve not tested this exploit yet. OK here what is as explained from by alex (translated from spanish) :
  The error comes from wp_suggestCategories() function in xmlrpc.php file. As it is possible to be observed in that function, a conversion to whole number doesn’t become the value of $max_results, reason why user_login is possible to send values of the type 0 UNION ALL SELECT, user_pass FROM wp_users. Alex gives the exploit which gives back the list of users with his respective passwords in MD5, in addition it also includes the cookies of authentication for each user. In order to correct this problem is to change line $max_results = $args [] of the function wp_suggestCategories() by $max_results = (int) $args [4]. See Changeset 5570. This exploit just viable for blog with user registration enabled
  CMIIW
• WordPress Template.PHP HTML Injection Vulnerability by David Kierznowski
  A kind of CSRF vulnerability. See Changeset 4665
• WordPress Persistent XSS by David Kierznowski which affects the latest version v2.0.5. See Changeset 4665
• WordPress 2.1.3 admin-ajax.php SQL Injection Blind Fishing Exploit by Janek Vind a.k.a waraxe. This is a critical security for 2.1.3
  

And much more for old version. See also :

• WordPress Trac
• All vulnerabilities archieve at SecurityFocus, sort vendor to WordPress
• WP Exploits and Vulners at milw0rm
• David Kierznowski’s blog
• Buayacorp’s blog (Spanish)