Linux Distros Unpatched Vulnerability : CVE-2019-16218

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress before 5.2.3 allows XSS in stored comments. CVE-2019-16218 Note that Nessus relies on the presence of the package as reported by the vendor...

StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload

Exploit Title: StoryChief Wordpress Plugin 1.0.42 - Arbitrary File Upload Exploit Author: xpl0dec Vendor Homepage: https://www.storychief.io/wordpress-content-scheduler Software Link: https://github.com/Story-Chief/wordpress/ Version: ”; ? 2. Adjust the echo phpinfo section as needed 3. Host it o...

PT-2025-34747 · WordPress · Tourfic

Name of the Vulnerable Software and Affected Versions: Tourfic plugin for WordPress versions up to and including 2.14.5 Description: The Tourfic plugin for WordPress is susceptible to unauthorized data modification due to a missing capability check in the following functions: tf order status emai...

CVE-2025-9048

The Wptobe-memberships plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delimgajaxcall function in all versions up to, and including, 3.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

Linux Distros Unpatched Vulnerability : CVE-2017-8295

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2016-4566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject...

Linux Distros Unpatched Vulnerability : CVE-2017-9062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. CVE-2017-9062 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2016-4567

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attacker...

Linux Distros Unpatched Vulnerability : CVE-2017-16510

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress before 4.8.3 is affected by an issue where $wpdb-prepare can create unexpected and unsafe queries leading to potential SQL injection SQLi in plugins a...

Linux Distros Unpatched Vulnerability : CVE-2017-9063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In WordPress before 4.7.5, a cross-site scripting XSS vulnerability related to the Customizer exists, involving an invalid customization session. CVE-2017-9063...

Linux Distros Unpatched Vulnerability : CVE-2019-9787

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occu...

Linux Distros Unpatched Vulnerability : CVE-2017-6815

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In WordPress before 4.7.3 wp-includes/pluggable.php, control characters can trick redirect URL validation. CVE-2017-6815 Note that Nessus relies on the presence...

Linux Distros Unpatched Vulnerability : CVE-2017-6814

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In WordPress before 4.7.3, there is authenticated Cross-Site Scripting XSS via Media File Metadata. This is demonstrated by both 1 mishandling of the playlist...

Linux Distros Unpatched Vulnerability : CVE-2018-12895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passe...

Linux Distros Unpatched Vulnerability : CVE-2016-7169

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Directory traversal vulnerability in the FileUploadUpgrader class in wp-admin/includes/class-file- upload-upgrader.php in the upgrade package uploader in...

Linux Distros Unpatched Vulnerability : CVE-2017-5488

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple cross-site scripting XSS vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or...

Linux Distros Unpatched Vulnerability : CVE-2017-5490

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in the theme-name fallback functionality in wp-includes/class-wp- theme.php in WordPress before 4.7.1 allows remote...

Linux Distros Unpatched Vulnerability : CVE-2016-5837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors...

Linux Distros Unpatched Vulnerability : CVE-2016-5833

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in the columntitle function in wp-admin/includes/class-wp-media- list-table.php in WordPress before 4.5.3 allows remote...

Linux Distros Unpatched Vulnerability : CVE-2006-0733

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as 1...