171 results · Feed
-
Unscored —
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.
-
Unscored —
Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/u…
-
Unscored —
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchiv…
-
Unscored —
Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or…
-
Unscored —
Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template …
-
Unscored —
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files…
-
Unscored —
In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialo…
-
Unscored —
In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.
-
Unscored —
In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.
-
Unscored —
In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
-
Unscored —
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an in…
-
Unscored —
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for r…
-
Unscored —
In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.
-
Unscored —
In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstra…
-
Unscored —
In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin de…
-
Unscored —
In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-t…
-
Unscored —
In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Emb…
-
Unscored —
wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility…
-
Unscored —CVE-2017-5611 EPSS 10%
SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attac…
-
Unscored —
Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in …
-
Unscored —
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPr…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions…
-
Unscored —
The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_dat…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.…
-
Unscored —
wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofe…
-
Unscored —
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random n…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote …
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authent…
-
Unscored —
Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPres…
-
Unscored —
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, w…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers t…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-a…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in Wor…
-
Unscored —
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the abili…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.ph…
-
Unscored —
WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified ve…
-
Unscored —
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge …
-
Unscored —
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute f…