Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 9 | wordpress | 4.7.18+dfsg-1+deb9u1 |
Vulnerabilities 6
-
Medium 6.8
Authenticated XSS via media attachment page in WordPress
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user wh…
-
Medium 5.7
Open redirect in wp_validate_redirect() in WordPress
In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previousl…
-
Low 3.5
set-screen-option filter misuse by plugins leading to privilege escalation in WordPress
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low pri…
-
Low 2.4
Authenticated self-XSS via theme uploads in WordPress
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XS…
-
Unscored —
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled duri…
-
Unscored —
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in …