CVE-2016-2221

CVE-2016-2221 corresponds to an open redirect in WordPress prior to 4.4.2 via wp_validate_redirect in wp-includes/pluggable.php. The vulnerability allows remote attackers to redirect users to arbitrary sites and potentially enable phishing through malformed URLs that trigger incorrect hostname pa...

CVE-2014-0166

The wpvalidateauthcookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie...