171 results · Feed
-
Unscored —
The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspec…
-
Unscored —
The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via u…
-
Unscored —
Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.…
-
Unscored —
Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enab…
-
Unscored —
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, do…
-
Unscored —
wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on wh…
-
Unscored —
wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and u…
-
Unscored —
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, pe…
-
Unscored —CVE-2013-7233 Public exploit
Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPr…
-
Unscored —
WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes i…
-
Unscored —
WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, …