CVE-2017-6819: Cross-Site Request Forgery (CSRF)

In WordPress before 4.7.3, there is cross-site request forgery CSRF in Press This wp-admin/includes/class-wp-press-this.php, leading to excessive use of server resources. The CSRF can trigger an outbound HTTP request for a large file that is then parsed by Press This...

CVE-2017-6817: Improper Neutralization of Input During Web Page Generation

In WordPress before 4.7.3 wp-includes/embed.php, there is authenticated Cross-Site Scripting XSS in YouTube URL Embeds...

CVE-2017-6815: Improper Input Validation

In WordPress before 4.7.3 wp-includes/pluggable.php, control characters can trick redirect URL validation...

CVE-2017-6814: Improper Neutralization of Input During Web Page Generation

In WordPress before 4.7.3, there is authenticated Cross-Site Scripting XSS via Media File Metadata. This is demonstrated by both 1 mishandling of the playlist shortcode in the wpplaylistshortcode function in wp-includes/media.php and 2 mishandling of meta information in the renderTracks function ...

CVE-2016-6285: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in includes/decorators/global-translations.jsp in Atlassian JIRA before 7.2.2 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header...

PT-2017-8955

Name of the Vulnerable Software and Affected Versions Atlassian JIRA versions prior to 7.2.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header. This affects the includes/decorators/global-translations.jsp file...

Sql injection

SQL injection vulnerability in wp-includes/class-wp-query.php in WPQuery in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name...

CVE-2017-5611

SQL injection vulnerability in wp-includes/class-wp-query.php in WPQuery in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name...

CVE-2017-5612

Cross-site scripting XSS vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt...

CVE-2017-5612: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt...

CVE-2017-5611: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in wp-includes/class-wp-query.php in WPQuery in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name...

PT-2017-4047

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.7.2 Description The issue is related to a SQL injection vulnerability in the WP Query function, specifically in the wp-includes/class-wp-query.php file. This vulnerability can be exploited by remote attackers to...

PT-2017-16570

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.0.5 Description The issue allows remote attackers to conduct PHP Object Injection attacks. This is achieved by sending crafted serialized data in a salt cookie within a login request to the...

PT-2017-7770

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.6 Description The issue allows remote authenticated users to bypass intended read-access restrictions. This is related to the wp ajax update plugin function in wp-admin/includes/ajax-actions.php, which makes a get...

CVE-2017-5493

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...

CVE-2017-5492

Cross-site request forgery CSRF vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php...

CVE-2017-5490

Cross-site scripting XSS vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to...

CVE-2017-5490

Cross-site scripting XSS vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to...

CVE-2017-5493: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...

CVE-2017-5490: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to...