354 results · Feed
-
Unscored —
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for r…
-
Unscored —
The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in Wo…
-
Unscored —
In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.
-
Unscored —
In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstra…
-
Unscored —
In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin de…
-
Unscored —
In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-t…
-
Unscored —
In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Emb…
-
Unscored —
In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names.
-
Unscored —
wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility…
-
Unscored —CVE-2017-5611 EPSS 10%
SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attac…
-
Unscored —
Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in …
-
Unscored —
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPr…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions…
-
Unscored —
The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_dat…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.…
-
Unscored —
wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofe…
-
Unscored —
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 befor…
-
Unscored —
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random n…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote …
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authent…
-
Unscored —
Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPres…
-
Unscored —
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, w…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers t…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-a…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in Wor…
-
Unscored —
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the abili…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.ph…
-
Unscored —
WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified ve…
-
Unscored —
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge …
-
Unscored —
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute f…
-
Unscored —
The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspec…
-
Unscored —
The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via u…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated u…
-
Unscored —
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to …
-
Unscored —
Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web scri…
-
Unscored —
The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 al…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow r…
-
Unscored —
Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.…