wordpress vulnerabilities (Ubuntu)
170 vulnerabilities.
wordpressUbuntuWordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail...8.8 HighwordpressUbuntuWordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing...8.8 HighwordpressUbuntuIn WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This...7.2 HighwordpressUbuntuWordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory...8.8 HighwordpressUbuntuWordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or...6.1 MediumwordpressUbuntuBefore WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and...6.1 MediumwordpressUbuntuBefore WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if...6.1 MediumwordpressUbuntuIn WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource...7.5 HighwordpressUbuntuWordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js...6.1 MediumwordpressUbuntuwp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and...5.4 MediumwordpressUbuntuwp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang...5.4 MediumwordpressUbuntuwp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html...5.4 MediumwordpressUbuntuwp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be...8.8 HighwordpressUbuntuWordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and...9.8 CriticalwordpressUbuntuWordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier...7.5 HighwordpressUbuntuWordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous...6.5 MediumwordpressUbuntuBefore version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in...6.1 MediumwordpressUbuntuBefore version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag...5.4 MediumwordpressUbuntuBefore version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.6.1 MediumwordpressUbuntuBefore version 4.8.2, WordPress mishandled % characters and additional placeholder values in ...9.8 CriticalwordpressUbuntuBefore version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component...7.5 HighwordpressUbuntuBefore version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted...6.1 MediumwordpressUbuntuBefore version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view...6.1 MediumwordpressUbuntuBefore version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip...7.5 HighwordpressUbuntuBefore version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link...6.1 MediumwordpressUbuntuIn WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading...8.6 HighwordpressUbuntuIn WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC...7.5 HighwordpressUbuntuIn WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the...8.8 HighwordpressUbuntuIn WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer...6.1 MediumwordpressUbuntuIn WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.8.6 HighwordpressUbuntuIn WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to...6.1 MediumwordpressUbuntuWordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which...5.9 MediumwordpressUbuntuIn WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin...6.5 MediumwordpressUbuntuIn WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting ...5.4 MediumwordpressUbuntuIn WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by...4.9 MediumwordpressUbuntuIn WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL...6.1 MediumwordpressUbuntuIn WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File...5.4 MediumwordpressUbuntuCross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in...6.1 MediumwordpressUbuntuSQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7...9.8 CriticalwordpressUbuntuwp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not...5.3 MediumwordpressUbuntuCross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin...6.5 MediumwordpressUbuntuDirectory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax...7.1 HighwordpressUbuntuThe wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6...4.3 MediumwordpressUbuntuwp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not...7.5 HighwordpressUbuntuCross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature...8.8 HighwordpressUbuntuwp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting...5.3 MediumwordpressUbuntuCross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes...6.1 MediumwordpressUbuntuCross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers...8.8 HighwordpressUbuntuMultiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress...6.1 MediumwordpressUbuntuDirectory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class...6.3 Medium- Show moreLoading…