Unscored DSA-2718-1 8 CVEs

wordpress - several

Published Jul 1, 2013 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

Release	Package	Fixed in
Debian · 6.0	wordpress	3.5.2+dfsg-1~deb6u1
Debian · 7	wordpress	3.5.2+dfsg-1~deb7u1

Vulnerabilities 8

Unscored —

CVE-2013-2173

wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to caus…

wordpress Debian

Jun 21, 2013
Unscored —

CVE-2013-2199

The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecifie…

wordpress Debian

Jul 8, 2013
Unscored —

CVE-2013-2200

WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to by…

wordpress Debian

Jul 8, 2013
Unscored —

CVE-2013-2201

Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrar…

wordpress Debian

Jul 8, 2013
Unscored —

CVE-2013-2202

WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing a…

wordpress Debian

Jul 8, 2013
Unscored —

CVE-2013-2203

WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive in…

wordpress Debian

Jul 8, 2013
Unscored —

CVE-2013-2204

moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other produc…

wordpress Debian

Jul 8, 2013
Unscored —

CVE-2013-2205

The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, whi…

wordpress Debian

Jul 8, 2013