Overview 411 matches · 0 in Waratek scope · 0 protected · 20 exploited · 5 CISA KEV · 98 public PoC · 16 EPSS ≥ 0.5
411matches
0in Waratek scope0.0%
0protected0.0%
20exploited4.9%
5CISA KEV1.2%
98public PoC23.8%
16EPSS ≥ 0.53.9%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
0.2%
Not applicable
410
99.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
411
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 48 / year
20042
Not applicable2
Medium2
not blocked2
Working exploit published2
200510
Not applicable10
High4
Medium6
not blocked10
Working exploit published2
No public exploit8
200616
Not applicable16
High3
Medium12
Low1
not blocked16
Working exploit published3
No public exploit13
200747
Not applicable47
Critical1
High6
Medium37
Low3
not blocked47
Working exploit published15
No public exploit32
200848
Not applicable48
High23
Medium25
not blocked48
Working exploit published26
No public exploit22
200916
Not applicable16
High3
Medium12
Low1
not blocked16
Working exploit published7
No public exploit9
20102
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
201112
Not applicable12
High5
Medium6
Low1
not blocked12
No public exploit12
201232
Not applicable32
High4
Medium23
Low5
not blocked32
Working exploit published12
No public exploit20
201320
Not applicable20
High2
Medium15
Low3
not blocked20
Working exploit published2
No public exploit18
201429
Not applicable29
High3
Medium24
Low2
not blocked29
Working exploit published2
Proof of concept only1
No public exploit26
201511
Not applicable11
High1
Medium9
Low1
not blocked11
Exploited1
No public exploit10
201622
Not applicable22
Critical2
High10
Medium10
not blocked22
Exploited1
Working exploit published1
No public exploit20
201746
Outside Waratek scope1
Not applicable45
Critical3
High13
Medium30
not blocked46
Exploited5
Working exploit published5
No public exploit36
201818
Not applicable18
Critical1
High8
Medium9
not blocked18
Exploited1
Working exploit published1
Forecast only1
No public exploit15
201923
Not applicable23
Critical3
High4
Medium16
not blocked23
Exploited1
Working exploit published3
No public exploit19
202021
Not applicable21
Critical5
High4
Medium10
Low2
not blocked21
Exploited1
Working exploit published1
No public exploit19
20219
Not applicable9
Critical3
High3
Medium3
not blocked9
Exploited1
Working exploit published1
No public exploit7
20229
Not applicable9
High4
Medium5
not blocked9
Exploited3
Proof of concept only1
No public exploit5
20239
Not applicable9
High3
Medium6
not blocked9
Exploited1
Working exploit published1
No public exploit7
20245
Not applicable5
Critical1
High3
Medium1
not blocked5
Exploited1
Working exploit published1
No public exploit3
20250
20264
Not applicable4
Critical1
High2
Medium1
not blocked4
Exploited4
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2017-17092 | Medium | 2017-12-02 | Not applicable | Working exploit published | wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file. |
| CVE-2017-17091 | High | 2017-12-02 | Not applicable | No public exploit | wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string. |
| CVE-2017-16510 | Critical | 2017-11-02 | Not applicable | No public exploit | WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723. |
| CVE-2012-6707 | High | 2017-10-19 | Not applicable | No public exploit | WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions. |
| CVE-2016-9263 | Medium | 2017-10-12 | Not applicable | No public exploit | WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file. |
| CVE-2017-14990 | Medium | 2017-10-03 | Not applicable | No public exploit | WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified SQL injection vulnerability). |
| CVE-2017-14726 | Medium | 2017-09-23 | Not applicable | Exploited | Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. |
| CVE-2017-14725 | Medium | 2017-09-23 | Not applicable | Working exploit published | Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php. |
| CVE-2017-14724 | Medium | 2017-09-23 | Not applicable | No public exploit | Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery. |
| CVE-2017-14723 | Critical | 2017-09-23 | Not applicable | Exploited | Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks. |
| CVE-2017-14722 | High | 2017-09-23 | Not applicable | No public exploit | Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename. |
| CVE-2017-14721 | Medium | 2017-09-23 | Not applicable | No public exploit | Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name. |
| CVE-2017-14720 | Medium | 2017-09-23 | Not applicable | No public exploit | Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. |
| CVE-2017-14719 | High | 2017-09-23 | Not applicable | No public exploit | Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components. |
| CVE-2017-14718 | Medium | 2017-09-23 | Not applicable | No public exploit | Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. |
| CVE-2017-9066 | High | 2017-05-18 | Not applicable | No public exploit | In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF. |
| CVE-2017-9065 | High | 2017-05-18 | Not applicable | No public exploit | In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API. |
| CVE-2017-9064 | High | 2017-05-18 | Not applicable | No public exploit | In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials. |
| CVE-2017-9063 | Medium | 2017-05-18 | Not applicable | No public exploit | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session. |
| CVE-2017-9062 | High | 2017-05-18 | Not applicable | No public exploit | In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. |
| CVE-2017-9061 | Medium | 2017-05-18 | Not applicable | No public exploit | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename. |
| CVE-2017-8295 | Medium | 2017-05-04 | Not applicable | Exploited | WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message. |
| CVE-2017-1001000 | High | 2017-04-03 | Not applicable | Exploited | The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld URI. |
| CVE-2017-6819 | Medium | 2017-03-12 | Not applicable | No public exploit | In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources. The CSRF can trigger an outbound HTTP request for a large file that is then parsed by Press This. |
| CVE-2017-6818 | Medium | 2017-03-12 | Not applicable | No public exploit | In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names. |
| CVE-2017-6817 | Medium | 2017-03-12 | Not applicable | No public exploit | In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds. |
| CVE-2017-6816 | Medium | 2017-03-12 | Not applicable | No public exploit | In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality. |
| CVE-2017-6815 | Medium | 2017-03-12 | Not applicable | No public exploit | In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. |
| CVE-2017-6814 | Medium | 2017-03-12 | Not applicable | No public exploit | In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js. |
| CVE-2017-5612 | Medium | 2017-01-30 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt. |
| CVE-2017-5611 | Critical | 2017-01-30 | Outside Waratek scope | Exploited | SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name. |
| CVE-2017-5610 | Medium | 2017-01-30 | Not applicable | No public exploit | wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms. |
| CVE-2016-6897 | Medium | 2017-01-18 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896. |
| CVE-2016-6896 | High | 2017-01-18 | Not applicable | Working exploit published | Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool. |
| CVE-2016-10148 | Medium | 2017-01-18 | Not applicable | No public exploit | The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896. |
| CVE-2017-5493 | High | 2017-01-15 | Not applicable | No public exploit | wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup. |
| CVE-2017-5492 | High | 2017-01-15 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php. |
| CVE-2017-5491 | Medium | 2017-01-15 | Not applicable | No public exploit | wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name. |
| CVE-2017-5490 | Medium | 2017-01-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php. |
| CVE-2017-5489 | High | 2017-01-15 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving a Flash file upload. |
| CVE-2017-5488 | Medium | 2017-01-15 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin. |
| CVE-2017-5487 | Medium | 2017-01-15 | Not applicable | Working exploit published | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request. |
| CVE-2016-7169 | Medium | 2017-01-05 | Not applicable | No public exploit | Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter. |
| CVE-2016-7168 | Medium | 2017-01-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename. |
| CVE-2016-10045 | Critical | 2016-12-30 | Not applicable | Working exploit published | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033. |
| CVE-2016-10033 | Critical | 2016-12-30 | Not applicable | Exploited | The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property. |
| CVE-2016-6635 | High | 2016-08-07 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option. |
| CVE-2016-6634 | Medium | 2016-08-07 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2016-4029 | High | 2016-08-07 | Not applicable | No public exploit | WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address. |
| CVE-2016-5839 | High | 2016-06-29 | Not applicable | No public exploit | WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors. |
| CVE-2016-5838 | High | 2016-06-29 | Not applicable | No public exploit | WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie. |
| CVE-2016-5837 | High | 2016-06-29 | Not applicable | No public exploit | WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors. |
| CVE-2016-5836 | High | 2016-06-29 | Not applicable | No public exploit | The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors. |
| CVE-2016-5835 | High | 2016-06-29 | Not applicable | No public exploit | WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php. |
| CVE-2016-5834 | Medium | 2016-06-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833. |
| CVE-2016-5833 | Medium | 2016-06-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834. |
| CVE-2016-5832 | High | 2016-06-29 | Not applicable | No public exploit | The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors. |
| CVE-2016-4567 | Medium | 2016-05-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn." |
| CVE-2016-4566 | Medium | 2016-05-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack. |
| CVE-2016-2222 | High | 2016-05-22 | Not applicable | No public exploit | The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php. |
| CVE-2016-2221 | High | 2016-05-22 | Not applicable | No public exploit | Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL. |
| CVE-2016-1564 | Medium | 2016-05-22 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php. |
| CVE-2015-8834 | Medium | 2016-05-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440. |
| CVE-2015-7989 | Medium | 2016-05-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714. |
| CVE-2015-5715 | Medium | 2016-05-22 | Not applicable | No public exploit | The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors. |
| CVE-2015-5714 | Medium | 2016-05-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags. |
| CVE-2015-5734 | Medium | 2015-11-09 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string. |
| CVE-2015-5733 | Medium | 2015-11-09 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title. |
| CVE-2015-5732 | Medium | 2015-11-09 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title. |
| CVE-2015-5731 | Medium | 2015-11-09 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests that lock a post, and consequently cause a denial of service (editing blockage), via a get-post-lock action. |
| CVE-2015-5730 | Medium | 2015-11-09 | Not applicable | No public exploit | The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated. |
| CVE-2015-2213 | High | 2015-11-09 | Not applicable | No public exploit | SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash. |
| CVE-2015-3439 | Medium | 2015-08-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as. |
| CVE-2015-3438 | Medium | 2015-08-05 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment. |
| CVE-2015-5623 | Medium | 2015-08-03 | Not applicable | No public exploit | WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php. |
| CVE-2015-5622 | Low | 2015-08-03 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php. |
| CVE-2015-3440 | Medium | 2015-08-03 | Not applicable | Exploited | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. |
| CVE-2014-9039 | Medium | 2014-11-25 | Not applicable | No public exploit | wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message. |
| CVE-2014-9038 | Medium | 2014-11-25 | Not applicable | No public exploit | wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource. |
| CVE-2014-9037 | Medium | 2014-11-25 | Not applicable | No public exploit | WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash. |
| CVE-2014-9036 | Medium | 2014-11-25 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post. |
| CVE-2014-9035 | Medium | 2014-11-25 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2014-9034 | Medium | 2014-11-25 | Not applicable | Working exploit published | wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016. |
| CVE-2014-9033 | Medium | 2014-11-25 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords. |
| CVE-2014-9032 | Medium | 2014-11-25 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2014-9031 | Medium | 2014-11-25 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject arbitrary web script or HTML via crafted use of shortcode brackets in a text field, as demonstrated by a comment or a post. |
| CVE-2003-1599 | High | 2014-10-27 | Not applicable | No public exploit | PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the $abspath variable. |
| CVE-2003-1598 | High | 2014-10-01 | Not applicable | No public exploit | SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable. |
| CVE-2014-5266 | Medium | 2014-08-18 | Not applicable | No public exploit | The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265. |
| CVE-2014-5265 | Medium | 2014-08-18 | Not applicable | No public exploit | The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. |
| CVE-2014-5240 | Low | 2014-08-18 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL. |
| CVE-2014-5205 | Medium | 2014-08-18 | Not applicable | No public exploit | wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack. |
| CVE-2014-5204 | Medium | 2014-08-18 | Not applicable | No public exploit | wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack. |
| CVE-2014-5203 | High | 2014-08-18 | Not applicable | No public exploit | wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data. |
| CVE-2014-0166 | Medium | 2014-04-10 | Not applicable | Proof of concept only | The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie. |
| CVE-2014-0165 | Medium | 2014-04-10 | Not applicable | No public exploit | WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php. |
| CVE-2012-6635 | Medium | 2014-01-21 | Not applicable | No public exploit | wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft. |
| CVE-2012-6634 | Medium | 2014-01-21 | Not applicable | No public exploit | wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a post_id value. |
| CVE-2012-6633 | Medium | 2014-01-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via an editable slug field. |
| CVE-2011-5270 | Medium | 2014-01-21 | Not applicable | No public exploit | wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticated users to perform publish actions by leveraging the Contributor role. |