Overview 264 matches · 0 in Waratek scope · 0 protected · 8 exploited · 1 CISA KEV · 59 public PoC · 5 EPSS ≥ 0.5
264matches
0in Waratek scope0.0%
0protected0.0%
8exploited3.0%
1CISA KEV0.4%
59public PoC22.3%
5EPSS ≥ 0.51.9%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
264
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
264
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 37 / year
20042
Not applicable2
Medium2
not blocked2
Working exploit published2
20056
Not applicable6
Medium6
not blocked6
No public exploit6
200612
Not applicable12
Medium12
not blocked12
Working exploit published1
No public exploit11
200737
Not applicable37
Medium37
not blocked37
Working exploit published11
No public exploit26
200825
Not applicable25
Medium25
not blocked25
Working exploit published10
No public exploit15
200912
Not applicable12
Medium12
not blocked12
Working exploit published6
No public exploit6
20102
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20116
Not applicable6
Medium6
not blocked6
No public exploit6
201223
Not applicable23
Medium23
not blocked23
Working exploit published10
No public exploit13
201315
Not applicable15
Medium15
not blocked15
Working exploit published2
No public exploit13
201424
Not applicable24
Medium24
not blocked24
Working exploit published2
Proof of concept only1
No public exploit21
20159
Not applicable9
Medium9
not blocked9
Exploited1
No public exploit8
201610
Not applicable10
Medium10
not blocked10
No public exploit10
201730
Not applicable30
Medium30
not blocked30
Exploited2
Working exploit published4
No public exploit24
20189
Not applicable9
Medium9
not blocked9
No public exploit9
201916
Not applicable16
Medium16
not blocked16
Working exploit published3
No public exploit13
202010
Not applicable10
Medium10
not blocked10
Exploited1
No public exploit9
20213
Not applicable3
Medium3
not blocked3
No public exploit3
20225
Not applicable5
Medium5
not blocked5
Exploited1
No public exploit4
20236
Not applicable6
Medium6
not blocked6
Exploited1
Working exploit published1
No public exploit4
20241
Not applicable1
Medium1
not blocked1
Exploited1
20250
20261
Not applicable1
Medium1
not blocked1
Exploited1
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-60137 | Medium | 2026-07-17 | Not applicable | Exploited | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter. |
| CVE-2022-4973 | Medium | 2024-10-16 | Not applicable | Exploited | WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page. |
| CVE-2023-5561 | Medium | 2023-10-16 | Not applicable | Working exploit published | WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack |
| CVE-2023-39999 | Medium | 2023-10-13 | Not applicable | No public exploit | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 through 5.0.19, from 4.9 through 4.9.23, from 4.8 through 4.8.22, from 4.7 through 4.7.26, from 4.6 through 4.6.26, from 4.5 through 4.5.29, from 4.4 through 4.4.30, from 4.3 through 4.3.31, from 4.2 through 4.2.35, from 4.1 through 4.1.38. |
| CVE-2023-38000 | Medium | 2023-10-13 | Not applicable | No public exploit | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions. |
| CVE-2023-2745 | Medium | 2023-05-17 | Not applicable | Exploited | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack. |
| CVE-2013-10021 | Medium | 2023-03-11 | Not applicable | No public exploit | A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function render of the file panels/class-debug-bar-queries.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.8.1 is able to address this issue. The patch is named 0842af8f8a556bc3e39b9ef758173b0a8a9ccbfc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222739. |
| CVE-2023-22622 | Medium | 2023-01-05 | Not applicable | No public exploit | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on installations with very few visits. |
| CVE-2022-3590 | Medium | 2022-12-14 | Not applicable | Exploited | WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden. |
| CVE-2022-43504 | Medium | 2022-12-05 | Not applicable | No public exploit | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7. |
| CVE-2022-43500 | Medium | 2022-12-05 | Not applicable | No public exploit | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. |
| CVE-2022-43497 | Medium | 2022-12-05 | Not applicable | No public exploit | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. |
| CVE-2011-1762 | Medium | 2022-04-18 | Not applicable | No public exploit | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission. |
| CVE-2021-39203 | Medium | 2021-09-09 | Not applicable | No public exploit | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release. |
| CVE-2021-39200 | Medium | 2021-09-09 | Not applicable | No public exploit | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on your behalf. This has been patched in WordPress 5.8.1, along with any older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix. |
| CVE-2021-29450 | Medium | 2021-04-15 | Not applicable | No public exploit | Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix. |
| CVE-2020-28040 | Medium | 2020-11-02 | Not applicable | No public exploit | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. |
| CVE-2020-28038 | Medium | 2020-11-02 | Not applicable | No public exploit | WordPress before 5.5.2 allows stored XSS via post slugs. |
| CVE-2020-28034 | Medium | 2020-11-02 | Not applicable | Exploited | WordPress before 5.5.2 allows XSS associated with global variables. |
| CVE-2020-25286 | Medium | 2020-09-13 | Not applicable | No public exploit | In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public. |
| CVE-2020-4048 | Medium | 2020-06-12 | Not applicable | No public exploit | In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34). |
| CVE-2020-4047 | Medium | 2020-06-12 | Not applicable | No public exploit | In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34). |
| CVE-2020-4046 | Medium | 2020-06-12 | Not applicable | No public exploit | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, 4.0.31, 3.9.32, 3.8.34, 3.7.34). |
| CVE-2020-11030 | Medium | 2020-04-30 | Not applicable | No public exploit | In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). |
| CVE-2020-11029 | Medium | 2020-04-30 | Not applicable | No public exploit | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). |
| CVE-2020-11025 | Medium | 2020-04-30 | Not applicable | No public exploit | In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33). |
| CVE-2019-20043 | Medium | 2019-12-27 | Not applicable | No public exploit | In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. |
| CVE-2019-20042 | Medium | 2019-12-27 | Not applicable | No public exploit | In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. |
| CVE-2019-16781 | Medium | 2019-12-26 | Not applicable | No public exploit | In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS. |
| CVE-2019-16780 | Medium | 2019-12-26 | Not applicable | No public exploit | WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. Automatic updates are enabled by default for minor releases and we strongly recommend that you keep them enabled. |
| CVE-2019-17674 | Medium | 2019-10-17 | Not applicable | No public exploit | WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer. |
| CVE-2019-17672 | Medium | 2019-10-17 | Not applicable | No public exploit | WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements. |
| CVE-2019-17671 | Medium | 2019-10-17 | Not applicable | Working exploit published | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled. |
| CVE-2019-16223 | Medium | 2019-09-11 | Not applicable | Working exploit published | WordPress before 5.2.3 allows XSS in post previews by authenticated users. |
| CVE-2019-16222 | Medium | 2019-09-11 | Not applicable | No public exploit | WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks. |
| CVE-2019-16221 | Medium | 2019-09-11 | Not applicable | No public exploit | WordPress before 5.2.3 allows reflected XSS in the dashboard. |
| CVE-2019-16220 | Medium | 2019-09-11 | Not applicable | No public exploit | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash. |
| CVE-2019-16219 | Medium | 2019-09-11 | Not applicable | No public exploit | WordPress before 5.2.3 allows XSS in shortcode previews. |
| CVE-2019-16218 | Medium | 2019-09-11 | Not applicable | No public exploit | WordPress before 5.2.3 allows XSS in stored comments. |
| CVE-2019-16217 | Medium | 2019-09-11 | Not applicable | No public exploit | WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. |
| CVE-2017-6514 | Medium | 2019-05-22 | Not applicable | No public exploit | WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring. |
| CVE-2019-8943 | Medium | 2019-02-20 | Not applicable | Working exploit published | WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring. |
| CVE-2018-20153 | Medium | 2018-12-14 | Not applicable | No public exploit | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS. |
| CVE-2018-20152 | Medium | 2018-12-14 | Not applicable | No public exploit | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input. |
| CVE-2018-20150 | Medium | 2018-12-14 | Not applicable | No public exploit | In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins. |
| CVE-2018-20149 | Medium | 2018-12-14 | Not applicable | No public exploit | In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data. |
| CVE-2018-20147 | Medium | 2018-12-14 | Not applicable | No public exploit | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files. |
| CVE-2018-10102 | Medium | 2018-04-16 | Not applicable | No public exploit | Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag. |
| CVE-2018-10101 | Medium | 2018-04-16 | Not applicable | No public exploit | Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server. |
| CVE-2018-10100 | Medium | 2018-04-16 | Not applicable | No public exploit | Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS. |
| CVE-2018-5776 | Medium | 2018-01-18 | Not applicable | No public exploit | WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement). |
| CVE-2017-17094 | Medium | 2017-12-02 | Not applicable | No public exploit | wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL. |
| CVE-2017-17093 | Medium | 2017-12-02 | Not applicable | No public exploit | wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site. |
| CVE-2017-17092 | Medium | 2017-12-02 | Not applicable | Working exploit published | wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file. |
| CVE-2016-9263 | Medium | 2017-10-12 | Not applicable | No public exploit | WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file. |
| CVE-2017-14990 | Medium | 2017-10-03 | Not applicable | No public exploit | WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified SQL injection vulnerability). |
| CVE-2017-14726 | Medium | 2017-09-23 | Not applicable | Exploited | Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. |
| CVE-2017-14725 | Medium | 2017-09-23 | Not applicable | Working exploit published | Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php. |
| CVE-2017-14724 | Medium | 2017-09-23 | Not applicable | No public exploit | Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery. |
| CVE-2017-14721 | Medium | 2017-09-23 | Not applicable | No public exploit | Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name. |
| CVE-2017-14720 | Medium | 2017-09-23 | Not applicable | No public exploit | Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. |
| CVE-2017-14718 | Medium | 2017-09-23 | Not applicable | No public exploit | Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. |
| CVE-2017-9063 | Medium | 2017-05-18 | Not applicable | No public exploit | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session. |
| CVE-2017-9061 | Medium | 2017-05-18 | Not applicable | No public exploit | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename. |
| CVE-2017-8295 | Medium | 2017-05-04 | Not applicable | Exploited | WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to problematic use of the SERVER_NAME variable in wp-includes/pluggable.php in conjunction with the PHP mail function. Exploitation is not achievable in all cases because it requires at least one of the following: (1) the attacker can prevent the victim from receiving any e-mail messages for an extended period of time (such as 5 days), (2) the victim's e-mail system sends an autoresponse containing the original message, or (3) the victim manually composes a reply containing the original message. |
| CVE-2017-6819 | Medium | 2017-03-12 | Not applicable | No public exploit | In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources. The CSRF can trigger an outbound HTTP request for a large file that is then parsed by Press This. |
| CVE-2017-6818 | Medium | 2017-03-12 | Not applicable | No public exploit | In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names. |
| CVE-2017-6817 | Medium | 2017-03-12 | Not applicable | No public exploit | In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds. |
| CVE-2017-6816 | Medium | 2017-03-12 | Not applicable | No public exploit | In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality. |
| CVE-2017-6815 | Medium | 2017-03-12 | Not applicable | No public exploit | In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. |
| CVE-2017-6814 | Medium | 2017-03-12 | Not applicable | No public exploit | In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js. |
| CVE-2017-5612 | Medium | 2017-01-30 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt. |
| CVE-2017-5610 | Medium | 2017-01-30 | Not applicable | No public exploit | wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms. |
| CVE-2016-6897 | Medium | 2017-01-18 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896. |
| CVE-2016-10148 | Medium | 2017-01-18 | Not applicable | No public exploit | The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896. |
| CVE-2017-5491 | Medium | 2017-01-15 | Not applicable | No public exploit | wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name. |
| CVE-2017-5490 | Medium | 2017-01-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php. |
| CVE-2017-5488 | Medium | 2017-01-15 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin. |
| CVE-2017-5487 | Medium | 2017-01-15 | Not applicable | Working exploit published | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request. |
| CVE-2016-7169 | Medium | 2017-01-05 | Not applicable | No public exploit | Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter. |
| CVE-2016-7168 | Medium | 2017-01-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename. |
| CVE-2016-6634 | Medium | 2016-08-07 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2016-5834 | Medium | 2016-06-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833. |
| CVE-2016-5833 | Medium | 2016-06-29 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834. |
| CVE-2016-4567 | Medium | 2016-05-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn." |
| CVE-2016-4566 | Medium | 2016-05-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack. |
| CVE-2016-1564 | Medium | 2016-05-22 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php. |
| CVE-2015-8834 | Medium | 2016-05-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440. |
| CVE-2015-7989 | Medium | 2016-05-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714. |
| CVE-2015-5715 | Medium | 2016-05-22 | Not applicable | No public exploit | The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors. |
| CVE-2015-5714 | Medium | 2016-05-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags. |
| CVE-2015-5734 | Medium | 2015-11-09 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string. |
| CVE-2015-5733 | Medium | 2015-11-09 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title. |
| CVE-2015-5732 | Medium | 2015-11-09 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title. |
| CVE-2015-5731 | Medium | 2015-11-09 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests that lock a post, and consequently cause a denial of service (editing blockage), via a get-post-lock action. |
| CVE-2015-5730 | Medium | 2015-11-09 | Not applicable | No public exploit | The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated. |
| CVE-2015-3439 | Medium | 2015-08-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as. |
| CVE-2015-3438 | Medium | 2015-08-05 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment. |
| CVE-2015-5623 | Medium | 2015-08-03 | Not applicable | No public exploit | WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php. |
| CVE-2015-3440 | Medium | 2015-08-03 | Not applicable | Exploited | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. |