wordpress vulnerabilities (Debian)
362 vulnerabilities.
wordpressDebianWordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.9.8 CriticalwordpressDebianIn wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could...5.3 MediumwordpressDebianAuthenticated XSS via media attachment page in WordPress6.8 MediumwordpressDebianOpen redirect in wp_validate_redirect() in WordPress5.7 MediumwordpressDebianAuthenticated self-XSS via theme uploads in WordPress2.4 LowwordpressDebianset-screen-option filter misuse by plugins leading to privilege escalation in WordPress3.5 LowwordpressDebianAuthenticated XSS through embed block in WordPress5.4 MediumwordpressDebianSpecially crafted filenames in WordPress leading to XSS8.7 HighwordpressDebianUnauthenticated disclosure of certain private posts in WordPress5.8 MediumwordpressDebianCross-site scripting in stats method (object cache) in WordPress5.8 MediumwordpressDebianCross-site scripting (XSS) in Search block in WordPress6.4 MediumwordpressDebianAuthenticated cross-site scripting (XSS) in WordPress Customizer5.8 MediumwordpressDebianPassword reset links invalidation issue in WordPress6.1 MediumwordpressDebianwp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon...9.8 CriticalwordpressDebianWordPress before 5.3.1 allowed an attacker to create a cross-site scripting attack (XSS) in well...6.1 MediumwordpressDebianWordPress before 5.3.1 allowed an unauthenticated user to make a post sticky through the REST API...4.3 MediumwordpressDebianStored cross-site scripting (XSS) in WordPress block editor5.8 MediumwordpressDebianStored cross-site scripting (XSS) in WordPress block editor5.8 MediumwordpressDebianIn WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the...5.3 MediumwordpressDebianWordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE...6.1 MediumwordpressDebianWordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because...7.5 HighwordpressDebianWordPress before 5.2.4 does not properly consider type confusion during validation of the referer...8.8 HighwordpressDebianWordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer.5.4 MediumwordpressDebianWordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL...9.8 CriticalwordpressDebianWordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows...9.8 CriticalwordpressDebianWordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.6.1 MediumwordpressDebianWordPress before 5.2.3 allows XSS in shortcode previews.6.1 MediumwordpressDebianWordPress before 5.2.3 allows reflected XSS in the dashboard.6.1 MediumwordpressDebianWordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp...6.1 MediumwordpressDebianWordPress before 5.2.3 allows XSS in post previews by authenticated users.5.4 MediumwordpressDebianIn WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp...6.1 MediumwordpressDebianWordPress before 5.2.3 allows XSS in stored comments.6.1 MediumwordpressDebianWordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain...5.3 MediumwordpressDebianWordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution...8.8 HighwordpressDebianWordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges...6.5 MediumwordpressDebianWordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an...8.8 HighwordpressDebianIn WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by...5.4 MediumwordpressDebianIn WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on...6.5 MediumwordpressDebianIn WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a...7.5 HighwordpressDebianIn WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use...6.1 MediumwordpressDebianIn WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors...5.4 MediumwordpressDebianIn WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection...9.8 CriticalwordpressDebianIn WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended...6.5 MediumwordpressDebianWordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing...8.8 HighwordpressDebianIn WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This...7.2 HighwordpressDebianWordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory...8.8 HighwordpressDebianBefore WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and...6.1 MediumwordpressDebianBefore WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the...6.1 MediumwordpressDebianBefore WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if...6.1 MediumwordpressDebianIn WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource...7.5 High- Show moreLoading…