Wordpress
Page 2 of 6 — Wordpress CVEs from a corpus of 573, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-10100 | Medium | 6.1 | 2018-04-16 | Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS. |
CVE-2014-6412 | High | 8.1 | 2018-04-12 | WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach. |
CVE-2018-6389 | High | 7.5 | 2018-02-06 | In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (fro… |
CVE-2018-5776 | Medium | 6.1 | 2018-01-18 | WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement). |
CVE-2017-17094 | Medium | 5.4 | 2017-12-02 | wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks… |
CVE-2017-17093 | Medium | 5.4 | 2017-12-02 | wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to con… |
CVE-2017-17092 | Medium | 5.4 | 2017-12-02 | wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers… |
CVE-2017-17091 | High | 8.8 | 2017-12-02 | wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attacke… |
CVE-2017-16510 | Critical | 9.8 | 2017-11-02 | WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plu… |
CVE-2012-6707 | High | 7.5 | 2017-10-19 | WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging acces… |
CVE-2016-9263 | Medium | 4.7 | 2017-10-12 | WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF)… |
CVE-2017-14990 | Medium | 6.5 | 2017-10-03 | WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it… |
CVE-2017-14726 | Medium | 6.1 | 2017-09-23 | Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. |
CVE-2017-14725 | Medium | 5.4 | 2017-09-23 | Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php. |
CVE-2017-14724 | Medium | 6.1 | 2017-09-23 | Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery. |
CVE-2017-14723 | Critical | 9.8 | 2017-09-23 | Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility… |
CVE-2017-14722 | High | 7.5 | 2017-09-23 | Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename. |
CVE-2017-14721 | Medium | 6.1 | 2017-09-23 | Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name. |
CVE-2017-14720 | Medium | 6.1 | 2017-09-23 | Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. |
CVE-2017-14719 | High | 7.5 | 2017-09-23 | Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components. |
CVE-2017-14718 | Medium | 6.1 | 2017-09-23 | Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. |
CVE-2017-9066 | High | 8.6 | 2017-05-18 | In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF. |
CVE-2017-9065 | High | 7.5 | 2017-05-18 | In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API. |
CVE-2017-9064 | High | 8.8 | 2017-05-18 | In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for up… |
CVE-2017-9063 | Medium | 6.1 | 2017-05-18 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session. |
CVE-2017-9062 | High | 8.6 | 2017-05-18 | In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. |
CVE-2017-9061 | Medium | 6.1 | 2017-05-18 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not pro… |
CVE-2017-8295 | Medium | 5.9 | 2017-05-04 | WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passw… |
CVE-2017-1001000 | High | 7.5 | 2017-04-03 | The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not requ… |
CVE-2017-6819 | Medium | 6.5 | 2017-03-12 | In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of se… |
CVE-2017-6818 | Medium | 6.1 | 2017-03-12 | In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names. |
CVE-2017-6817 | Medium | 5.4 | 2017-03-12 | In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds. |
CVE-2017-6816 | Medium | 4.9 | 2017-03-12 | In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality. |
CVE-2017-6815 | Medium | 6.1 | 2017-03-12 | In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. |
CVE-2017-6814 | Medium | 5.4 | 2017-03-12 | In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playl… |
CVE-2017-5612 | Medium | 6.1 | 2017-01-30 | Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote att… |
CVE-2017-5611 | Critical | 9.8 | 2017-01-30 | SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands b… |
CVE-2017-5610 | Medium | 5.3 | 2017-01-30 | wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface… |
CVE-2016-6897 | Medium | 6.5 | 2017-01-18 | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remo… |
CVE-2016-6896 | High | 7.1 | 2017-01-18 | Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated us… |
CVE-2016-10148 | Medium | 4.3 | 2017-01-18 | The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugin… |
CVE-2017-5493 | High | 7.5 | 2017-01-15 | wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier f… |
CVE-2017-5492 | High | 8.8 | 2017-01-15 | Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack th… |
CVE-2017-5491 | Medium | 5.3 | 2017-01-15 | wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com… |
CVE-2017-5490 | Medium | 6.1 | 2017-01-15 | Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote att… |
CVE-2017-5489 | High | 8.8 | 2017-01-15 | Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vecto… |
CVE-2017-5488 | Medium | 6.1 | 2017-01-15 | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script… |
CVE-2017-5487 | Medium | 5.3 | 2017-01-15 | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listi… |
CVE-2016-7169 | Medium | 6.3 | 2017-01-05 | Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in Word… |
CVE-2016-7168 | Medium | 4.8 | 2017-01-05 | Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attack… |
CVE-2016-10045 | Critical | 9.8 | 2016-12-30 | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary co… |
CVE-2016-10033 | Critical | 9.8 | 2016-12-30 | The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and conseque… |
CVE-2016-6635 | High | 8.8 | 2016-08-07 | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allow… |
CVE-2016-6634 | Medium | 6.1 | 2016-08-07 | Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2016-4029 | High | 8.6 | 2016-08-07 | WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass a… |
CVE-2016-5839 | High | 7.5 | 2016-06-29 | WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors. |
CVE-2016-5838 | High | 7.5 | 2016-06-29 | WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie. |
CVE-2016-5837 | High | 7.5 | 2016-06-29 | WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors. |
CVE-2016-5836 | High | 7.5 | 2016-06-29 | The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors. |
CVE-2016-5835 | High | 7.5 | 2016-06-29 | WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/i… |
CVE-2016-5834 | Medium | 6.1 | 2016-06-29 | Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attack… |
CVE-2016-5833 | Medium | 6.1 | 2016-06-29 | Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remot… |
CVE-2016-5832 | High | 7.5 | 2016-06-29 | The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors. |
CVE-2016-4567 | Medium | 6.1 | 2016-05-22 | Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attac… |
CVE-2016-4566 | Medium | 6.1 | 2016-05-22 | Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject a… |
CVE-2016-2222 | High | 8.6 | 2016-05-22 | The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attac… |
CVE-2016-2221 | High | 7.4 | 2016-05-22 | Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect use… |
CVE-2016-1564 | Medium | 6.1 | 2016-05-22 | Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web… |
CVE-2015-8834 | Medium | 6.1 | 2016-05-22 | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2015-7989 | Medium | 5.4 | 2016-05-22 | Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or H… |
CVE-2015-5715 | Medium | 4.3 | 2016-05-22 | The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypas… |
CVE-2015-5714 | Medium | 6.1 | 2016-05-22 | Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling… |
CVE-2015-5734 | | 2015-11-09 | Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers… | |
CVE-2015-5733 | | 2015-11-09 | Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote… | |
CVE-2015-5732 | | 2015-11-09 | Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allo… | |
CVE-2015-5731 | | 2015-11-09 | Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administ… | |
CVE-2015-5730 | | 2015-11-09 | The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widge… | |
CVE-2015-2213 | | 2015-11-09 | SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbit… | |
CVE-2015-3439 | | 2015-08-05 | Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4… | |
CVE-2015-3438 | | 2015-08-05 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitra… | |
CVE-2015-5623 | | 2015-08-03 | WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and c… | |
CVE-2015-5622 | | 2015-08-03 | Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the A… | |
CVE-2015-3440 | | 2015-08-03 | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via… | |
CVE-2015-3429 | | 2015-06-17 | Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbit… | |
CVE-2014-9039 | | 2014-11-25 | wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leverag… | |
CVE-2014-9038 | | 2014-11-25 | wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side req… | |
CVE-2014-9037 | | 2014-11-25 | WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 200… | |
CVE-2014-9036 | | 2014-11-25 | Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inj… | |
CVE-2014-9035 | | 2014-11-25 | Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote at… | |
CVE-2014-9034 | | 2014-11-25 | wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial… | |
CVE-2014-9033 | | 2014-11-25 | Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication… | |
CVE-2014-9032 | | 2014-11-25 | Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to… | |
CVE-2014-9031 | | 2014-11-25 | Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attack… | |
CVE-2003-1599 | | 2014-10-27 | PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the $abs… | |
CVE-2003-1598 | | 2014-10-01 | SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable. | |
CVE-2014-5266 | | 2014-08-18 | The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in a… | |
CVE-2014-5265 | | 2014-08-18 | The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without consid… | |
CVE-2014-5240 | | 2014-08-18 | Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated adminis… | |
CVE-2014-5205 | | 2014-08-18 | wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it… | |
CVE-2014-5204 | | 2014-08-18 | wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrec… |