354 results · Feed
-
Unscored —
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry c…
-
Unscored —
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted in…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted met…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleti…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privi…
-
Unscored —
WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remo…
-
Unscored —CVE-2018-14028 EPSS 15%
In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files …
-
Unscored —
WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin…
-
Unscored —
Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in …
-
Unscored —
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPre…
-
Unscored —
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
-
Unscored —
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the…
-
Unscored —
WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).
-
Unscored —
wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from …
-
Unscored —
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which migh…
-
Unscored —
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML ele…
-
Unscored —
wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js f…
-
Unscored —
WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading …
-
Unscored —
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determ…
-
Unscored —
WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to con…
-
Unscored —
WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_ke…
-
Unscored —
Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme fi…
-
Unscored —
Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual ed…
-
Unscored —
Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus d…
-
Unscored —
Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.
-
Unscored —
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.
-
Unscored —
Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/u…
-
Unscored —
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchiv…
-
Unscored —
Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or…
-
Unscored —
Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template …
-
Unscored —
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files…
-
Unscored —
In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialo…
-
Unscored —
In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.
-
Unscored —
In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.
-
Unscored —
In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
-
Unscored —
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an in…