wordpress - security update

Fixed packages 1

Vulnerabilities 18

• Medium 5.8
  CVE-2019-16780

  Stored cross-site scripting (XSS) in WordPress block editor

  WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack …

  WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
  Dec 26, 2019
• Medium 5.8
  CVE-2019-16781

  Stored cross-site scripting (XSS) in WordPress block editor

  In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.

  WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
  Dec 26, 2019
• Unscored —
  CVE-2019-16217

  WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.

  wordpress wordpress Debian Ubuntu
  Sep 11, 2019
• Unscored —
  CVE-2019-16218

  WordPress before 5.2.3 allows XSS in stored comments.

  wordpress wordpress Debian Ubuntu
  Sep 11, 2019
• Unscored —
  CVE-2019-16219

  WordPress before 5.2.3 allows XSS in shortcode previews.

  wordpress wordpress Debian Ubuntu
  Sep 11, 2019
• Unscored —
  CVE-2019-16220

  In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php co…

  wordpress wordpress Debian Ubuntu
  Sep 11, 2019
• Unscored —
  CVE-2019-16221

  WordPress before 5.2.3 allows reflected XSS in the dashboard.

  wordpress wordpress Debian Ubuntu
  Sep 11, 2019
• Unscored —
  CVE-2019-16222

  WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can…

  wordpress wordpress Debian Ubuntu
  Sep 11, 2019
• Unscored —
  CVE-2019-16223 Public exploit

  WordPress before 5.2.3 allows XSS in post previews by authenticated users.

  wordpress wordpress Debian Ubuntu
  Sep 11, 2019
• Unscored —
  CVE-2019-17669

  WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider …

  wordpress wordpress Debian Ubuntu
  Oct 17, 2019
• Unscored —
  CVE-2019-17671 Public exploit Scanner template EPSS 37%

  In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is …

  wordpress wordpress Debian Ubuntu
  Oct 17, 2019
• Unscored —
  CVE-2019-17672

  WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.

  wordpress wordpress Debian Ubuntu
  Oct 17, 2019
• Unscored —
  CVE-2019-17673

  WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Var…

  wordpress wordpress Debian Ubuntu
  Oct 17, 2019
• Unscored —
  CVE-2019-17674

  WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer.

  wordpress wordpress Debian Ubuntu
  Oct 17, 2019
• Unscored —
  CVE-2019-17675

  WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, p…

  wordpress wordpress Debian Ubuntu
  Oct 17, 2019
• Unscored —
  CVE-2019-20041

  wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowin…

  wordpress wordpress Debian Ubuntu
  Dec 27, 2019
• Unscored —
  CVE-2019-20042

  In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particula…

  wordpress wordpress Debian Ubuntu
  Dec 27, 2019
• Unscored —
  CVE-2019-20043

  In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users …

  wordpress wordpress Debian Ubuntu
  Dec 27, 2019