171 results · Feed
-
Unscored —
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider …
-
Unscored —
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled duri…
-
Unscored —
WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.
-
Unscored —
WordPress before 5.2.3 allows XSS in shortcode previews.
-
Unscored —
WordPress before 5.2.3 allows reflected XSS in the dashboard.
-
Unscored —
WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can…
-
Unscored —CVE-2019-16223 Public exploit
WordPress before 5.2.3 allows XSS in post previews by authenticated users.
-
Unscored —
In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php co…
-
Unscored —
WordPress before 5.2.3 allows XSS in stored comments.
-
Unscored —
WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Pat…
-
Unscored —
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated us…
-
Unscored —
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry c…
-
Unscored —
WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted in…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted met…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleti…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files…
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
-
Unscored —
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privi…
-
Unscored —
WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can r…
-
Unscored —
WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remo…
-
Unscored —CVE-2018-14028 EPSS 15%
In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files …
-
Unscored —
WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin…
-
Unscored —
WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete …
-
Unscored —
Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in …
-
Unscored —
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
-
Unscored —
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the…
-
Unscored —
WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).
-
Unscored —
wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from …
-
Unscored —
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which migh…
-
Unscored —
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML ele…
-
Unscored —
wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js f…
-
Unscored —
WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading …
-
Unscored —
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determ…
-
Unscored —
WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_ke…
-
Unscored —
Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme fi…
-
Unscored —
Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual ed…
-
Unscored —
Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus d…
-
Unscored —
Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.