wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.
5.3CVSS
6.8AI Score
0.007EPSS
Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php ...
8.8CVSS
7.4AI Score
0.003EPSS
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
7.5CVSS
6.8AI Score
0.007EPSS
wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms.
5.3CVSS
6.9AI Score
0.005EPSS
SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.
Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.
6.1CVSS
6.6AI Score
0.002EPSS
WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring.
5.3CVSS
4.9AI Score
0.002EPSS
In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks fun...
5.4CVSS
5.4AI Score
0.001EPSS
In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.
6.1CVSS
6AI Score
0.003EPSS
In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.
4.9CVSS
5.4AI Score
0.002EPSS
In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.
5.4CVSS
5.4AI Score
0.001EPSS
In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names.
6.1CVSS
5.8AI Score
0.003EPSS
In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources. The CSRF can trigger an outbound HTTP request for a large file that is then parsed by Press This.
6.5CVSS
6.3AI Score
0.002EPSS
WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to tra...
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.
6.1CVSS
6.4AI Score
0.003EPSS
In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.
8.6CVSS
8.4AI Score
0.006EPSS
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.
6.1CVSS
6.4AI Score
0.003EPSS
In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.
8.8CVSS
8.6AI Score
0.004EPSS
In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.
7.5CVSS
7.8AI Score
0.008EPSS
In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.
8.6CVSS
8.3AI Score
0.011EPSS
WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require ad...
8.8CVSS
8.9AI Score
0.01EPSS
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
6.1CVSS
6AI Score
0.005EPSS
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
6.1CVSS
6.1AI Score
0.005EPSS
Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.
6.1CVSS
5.8AI Score
0.005EPSS
WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post....
8.8CVSS
8AI Score
0.457EPSS
In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then ex...
7.2CVSS
7.3AI Score
0.193EPSS
PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.
8.8CVSS
8.6AI Score
0.005EPSS
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.
6.5CVSS
7.6AI Score
0.002EPSS
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.
9.8CVSS
9.3AI Score
0.018EPSS
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
5.4CVSS
7AI Score
0.001EPSS
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
6.1CVSS
7.2AI Score
0.004EPSS
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.
7.5CVSS
8.4AI Score
0.007EPSS
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.
6.5CVSS
7.7AI Score
0.002EPSS
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.
5.4CVSS
7.1AI Score
0.002EPSS
WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).
6.1CVSS
5.9AI Score
0.002EPSS
In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.
7.5CVSS
7.2AI Score
0.29EPSS
WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.
6.1CVSS
6AI Score
0.008EPSS
6.1CVSS
5.9AI Score
0.005EPSS
6.1CVSS
6AI Score
0.032EPSS
In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash.
6.1CVSS
6.2AI Score
0.003EPSS
6.1CVSS
6AI Score
0.005EPSS
WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks.
6.1CVSS
5.8AI Score
0.005EPSS
5.4CVSS
5.5AI Score
0.005EPSS
WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This...
5.8CVSS
6.8AI Score
0.002EPSS
In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.
5.8CVSS
7AI Score
0.001EPSS
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.
9.8CVSS
9.3AI Score
0.015EPSS
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.
9.8CVSS
9.3AI Score
0.007EPSS
In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.
5.3CVSS
7AI Score
0.011EPSS
WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.
6.1CVSS
7.1AI Score
0.012EPSS
WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.
7.5CVSS
8.3AI Score
0.004EPSS