WordPress 4.5.x < 4.5.12 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

WordPress 3.7.x < 3.7.24 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

WordPress 4.7.x < 4.7.8 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

CVE-2017-17093

wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site...

PT-2017-14708

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.1 Description The issue is related to the lang attribute of an HTML element in the wp-includes/general-template.php file, which does not have proper restrictions. This might allow attackers to conduct cross-site...

CVE-2017-17093: Improper Neutralization of Input During Web Page Generation

wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site...

CVE-2007-1894

Cross-site scripting XSS vulnerability in wp-includes/general-template.php in WordPress before 20070309 allows remote attackers to inject arbitrary web script or HTML via the year parameter in the wptitle function...

CVE-2007-1894

CVE-2007-1894 describes an XSS in WordPress via the year parameter in wp_title, in the file wp-includes/general-template.php, before 20070309. The linked Debian advisory confirms fixes in WordPress versions 2.0.10-1 and 2.1.3-1 (DSA-1285-1). Other references (NVD OSV, OSV-DEBIAN) corroborate the ...

CVE-2007-1894

Cross-site scripting XSS vulnerability in wp-includes/general-template.php in WordPress before 20070309 allows remote attackers to inject arbitrary web script or HTML via the year parameter in the wptitle function...

WordPress <= 2.0.10 - XSS

Because of this vulnerability in wp-includes/general-template.php, the attackers can inject arbitrary web script or HTML via the "year" parameter in the wptitle function. Solution Update the WordPress to the latest available version at least 2.0.11...

CVE-2007-1894: Undefined Security Weakness

Cross-site scripting XSS vulnerability in wp-includes/general-template.php in WordPress before 20070309 allows remote attackers to inject arbitrary web script or HTML via the year parameter in the wptitle function...