Unscored DLA-1960-1 7 CVEs

wordpress - security update

Published Oct 16, 2019 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 8	wordpress	4.1.27+dfsg-0+deb8u1

Vulnerabilities 7

Unscored —

CVE-2019-16217

WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.

wordpress wordpress Debian Ubuntu

Sep 11, 2019
Unscored —

CVE-2019-16218

WordPress before 5.2.3 allows XSS in stored comments.

wordpress wordpress Debian Ubuntu

Sep 11, 2019
Unscored —

CVE-2019-16219

WordPress before 5.2.3 allows XSS in shortcode previews.

wordpress wordpress Debian Ubuntu

Sep 11, 2019
Unscored —

CVE-2019-16220

In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php co…

wordpress wordpress Debian Ubuntu

Sep 11, 2019
Unscored —

CVE-2019-16221

WordPress before 5.2.3 allows reflected XSS in the dashboard.

wordpress wordpress Debian Ubuntu

Sep 11, 2019
Unscored —

CVE-2019-16222

WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can…

wordpress wordpress Debian Ubuntu

Sep 11, 2019
Unscored —

CVE-2019-16223 Public exploit

WordPress before 5.2.3 allows XSS in post previews by authenticated users.

wordpress wordpress Debian Ubuntu

Sep 11, 2019