Design/Logic Flaw

WordPress before 5.2.3 allows XSS in shortcode previews...

CVE-2019-16217

WordPress before 5.2.3 allows XSS in media uploads because wpajaxuploadattachment is mishandled...

CVE-2019-16219

WordPress before 5.2.3 allows XSS in shortcode previews...

CVE-2019-16222

WordPress before 5.2.3 has an issue with URL sanitization in wpksesbadprotocolonce in wp-includes/kses.php that can lead to cross-site scripting XSS attacks...

CVE-2019-16223

WordPress before 5.2.3 allows XSS in post previews by authenticated users...

CVE-2019-15864

The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS...

Path traversal

The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure...

CVE-2013-7475

The contact-form-plugin plugin before 3.52 for WordPress has XSS...

PT-2019-7674 · WordPress · Wp-Google-Map-Plugin

Name of the Vulnerable Software and Affected Versions: wp-google-map-plugin versions prior to 3.1.2 Description: The issue is related to a Cross-Site Scripting XSS problem. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a website, potentially...

EUVD-2019-3544

The WaspThemes Visual CSS Style Editor aka yellow-pencil-visual-theme-customizer plugin before 7.2.1 for WordPress allows ypoptionupdate CSRF, as demonstrated by use of ypremoteget to obtain admin access...

WordPress 4.1.x < 4.1.26 Cross-Site Scripting

According to its self-reported version number, the detected WordPress application is affected by a cross-site scripting XSS vulnerability due to insufficient input sanitization in comment. Note that the scanner has not tested for these issues but has instead relied only on the application's...

WordPress 5.1.x < 5.1.1 Cross-Site Scripting

According to its self-reported version number, the detected WordPress application is affected by a cross-site scripting XSS vulnerability due to insufficient input sanitization in comment. Note that the scanner has not tested for these issues but has instead relied only on the application's...

WordPress 4.8.x < 4.8.9 Cross-Site Scripting

According to its self-reported version number, the detected WordPress application is affected by a cross-site scripting XSS vulnerability due to insufficient input sanitization in comment. Note that the scanner has not tested for these issues but has instead relied only on the application's...

WordPress 4.5.x < 4.5.17 Cross-Site Scripting

According to its self-reported version number, the detected WordPress application is affected by a cross-site scripting XSS vulnerability due to insufficient input sanitization in comment. Note that the scanner has not tested for these issues but has instead relied only on the application's...

WordPress 4.6.x < 4.6.14 Cross-Site Scripting

According to its self-reported version number, the detected WordPress application is affected by a cross-site scripting XSS vulnerability due to insufficient input sanitization in comment. Note that the scanner has not tested for these issues but has instead relied only on the application's...

WordPress 5.1 CSRF to Remote Code Execution

Impact An attacker can take over any WordPress site that has comments enabled by tricking an administrator of a target blog to visit a website set up by the attacker. As soon as the victim administrator visits the malicious website, a cross-site request forgery CSRF exploit is run against the...

CVE-2019-8942

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

Fedora 28 : wordpress (2018-2ef9089e89)

WordPress 4.9.5 Security and Maintenance Release WordPress 4.9.5 is now available. This is a security and maintenance release for all versions since WordPress 3.7. We strongly encourage you to update your sites immediately. WordPress versions 4.9.4 and earlier are affected by three security issue...

Cross-Site Scripting (XSS)

wordpress is vulnerable to cross-site scripting XSS. The vulnerability is possible due to the input of malicious URL for certain use cases involving plugins...

WordPress 4.3.x < 4.3.18 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Authors could alter meta data to delete files that they weren't authorized to. - Authors could create posts of unauthorized types with specially crafted input. -...