CVE-2019-9787

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

CVE-2019-9787: Cross-Site Request Forgery (CSRF)

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

PT-2017-7770

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.6 Description The issue allows remote authenticated users to bypass intended read-access restrictions. This is related to the wp ajax update plugin function in wp-admin/includes/ajax-actions.php, which makes a get...

PT-2017-9053

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.6 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack the authentication of subscribers for certain operations by leveraging a late call to the check ajax referer...

CVE-2016-6635

Cross-site request forgery CSRF vulnerability in the wpajaxwpcompressiontest function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option...

CVE-2016-6635

Cross-site request forgery CSRF vulnerability in the wpajaxwpcompressiontest function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option...

PT-2016-7010

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.5 Description A cross-site request forgery CSRF issue exists in the wp ajax wp compression test function, located in wp-admin/includes/ajax-actions.php, allowing remote attackers to hijack administrator...

CVE-2016-6635: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the wpajaxwpcompressiontest function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option...

CVE-2016-5835

WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php...

PT-2016-6703

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.5.3 Description The issue allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php...

CVE-2016-5835: Exposure of Sensitive Information to an Unauthorized Actor

WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php...