wordpress vulnerabilities (Debian)
362 vulnerabilities.
wordpressDebianWordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js...6.1 MediumwordpressDebianwp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and...5.4 MediumwordpressDebianwp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang...5.4 MediumwordpressDebianwp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html...5.4 MediumwordpressDebianwp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be...8.8 HighwordpressDebianwordpress - regression updateNo scorewordpressDebianWordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and...9.8 CriticalwordpressDebianWordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier...7.5 HighwordpressDebianWordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows...4.7 MediumwordpressDebianWordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous...6.5 MediumwordpressDebianBefore version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in...6.1 MediumwordpressDebianBefore version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag...5.4 MediumwordpressDebianBefore version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.6.1 MediumwordpressDebianBefore version 4.8.2, WordPress mishandled % characters and additional placeholder values in ...9.8 CriticalwordpressDebianBefore version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component...7.5 HighwordpressDebianBefore version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted...6.1 MediumwordpressDebianBefore version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view...6.1 MediumwordpressDebianBefore version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip...7.5 HighwordpressDebianBefore version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link...6.1 MediumwordpressDebianIn WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading...8.6 HighwordpressDebianIn WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC...7.5 HighwordpressDebianIn WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the...8.8 HighwordpressDebianIn WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer...6.1 MediumwordpressDebianIn WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.8.6 HighwordpressDebianIn WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to...6.1 MediumwordpressDebianWordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which...5.9 MediumwordpressDebianThe register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php...7.5 HighwordpressDebianIn WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin...6.5 MediumwordpressDebianIn WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via...6.1 MediumwordpressDebianIn WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting ...5.4 MediumwordpressDebianIn WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by...4.9 MediumwordpressDebianIn WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL...6.1 MediumwordpressDebianIn WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File...5.4 MediumwordpressDebianCross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in...6.1 MediumwordpressDebianSQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7...9.8 CriticalwordpressDebianwp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not...5.3 MediumwordpressDebianCross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin...6.5 MediumwordpressDebianDirectory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax...7.1 HighwordpressDebianThe wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6...4.3 MediumwordpressDebianwp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not...7.5 HighwordpressDebianCross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature...8.8 HighwordpressDebianwp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting...5.3 MediumwordpressDebianCross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes...6.1 MediumwordpressDebianCross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers...8.8 HighwordpressDebianMultiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress...6.1 MediumwordpressDebianwp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation...5.3 MediumwordpressDebianwordpress - regression updateNo scorewordpressDebianDirectory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class...6.3 MediumwordpressDebianCross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes...4.8 MediumwordpressDebianCross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp...8.8 High- Show moreLoading…