WordPress 4.5.x < 4.5.12 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

CVE-2017-17093

wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site...

CVE-2017-17093: Improper Neutralization of Input During Web Page Generation

wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site...

PT-2017-14708

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.1 Description The issue is related to the lang attribute of an HTML element in the wp-includes/general-template.php file, which does not have proper restrictions. This might allow attackers to conduct cross-site...

CVE-2007-1894: Undefined Security Weakness

Cross-site scripting XSS vulnerability in wp-includes/general-template.php in WordPress before 20070309 allows remote attackers to inject arbitrary web script or HTML via the year parameter in the wptitle function...