WordPress
by WordPress
Source repositories
CVEs (371)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-16222 | Med | 0.33 | 6.1 | 0.02 | Sep 11, 2019 | WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks. | ||
| CVE-2019-16221 | Med | 0.33 | 6.1 | 0.02 | Sep 11, 2019 | WordPress before 5.2.3 allows reflected XSS in the dashboard. | ||
| CVE-2019-16220 | Med | 0.33 | 6.1 | 0.03 | Sep 11, 2019 | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash. | ||
| CVE-2019-16219 | Med | 0.33 | 6.1 | 0.02 | Sep 11, 2019 | WordPress before 5.2.3 allows XSS in shortcode previews. | ||
| CVE-2019-16218 | Med | 0.33 | 6.1 | 0.02 | Sep 11, 2019 | WordPress before 5.2.3 allows XSS in stored comments. | ||
| CVE-2019-16217 | Med | 0.33 | 6.1 | 0.02 | Sep 11, 2019 | WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. | ||
| CVE-2018-20150 | Med | 0.33 | 6.1 | 0.04 | Dec 14, 2018 | In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins. | ||
| CVE-2018-10102 | Med | 0.33 | 6.1 | 0.04 | Apr 16, 2018 | Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag. | ||
| CVE-2018-10101 | Med | 0.33 | 6.1 | 0.03 | Apr 16, 2018 | Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server. | ||
| CVE-2018-10100 | Med | 0.33 | 6.1 | 0.03 | Apr 16, 2018 | Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS. | ||
| CVE-2018-5776 | Med | 0.33 | 6.1 | 0.02 | Jan 18, 2018 | WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement). | ||
| CVE-2017-14726 | Med | 0.33 | 6.1 | 0.03 | Sep 23, 2017 | Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. | ||
| CVE-2017-14724 | Med | 0.33 | 6.1 | 0.03 | Sep 23, 2017 | Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery. | ||
| CVE-2017-14721 | Med | 0.33 | 6.1 | 0.02 | Sep 23, 2017 | Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name. | ||
| CVE-2017-14720 | Med | 0.33 | 6.1 | 0.02 | Sep 23, 2017 | Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. | ||
| CVE-2017-14718 | Med | 0.33 | 6.1 | 0.02 | Sep 23, 2017 | Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. | ||
| CVE-2017-9063 | Med | 0.33 | 6.1 | 0.02 | May 18, 2017 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session. | ||
| CVE-2017-9061 | Med | 0.33 | 6.1 | 0.02 | May 18, 2017 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename. | ||
| CVE-2017-6818 | Med | 0.33 | 6.1 | 0.03 | Mar 12, 2017 | In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names. | ||
| CVE-2017-6815 | Med | 0.33 | 6.1 | 0.03 | Mar 12, 2017 | In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. |
- risk 0.33cvss 6.1epss 0.02
WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks.
- risk 0.33cvss 6.1epss 0.02
WordPress before 5.2.3 allows reflected XSS in the dashboard.
- risk 0.33cvss 6.1epss 0.03
In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash.
- risk 0.33cvss 6.1epss 0.02
WordPress before 5.2.3 allows XSS in shortcode previews.
- risk 0.33cvss 6.1epss 0.02
WordPress before 5.2.3 allows XSS in stored comments.
- risk 0.33cvss 6.1epss 0.02
WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.
- risk 0.33cvss 6.1epss 0.04
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
- risk 0.33cvss 6.1epss 0.04
Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.
- risk 0.33cvss 6.1epss 0.03
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
- risk 0.33cvss 6.1epss 0.03
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
- risk 0.33cvss 6.1epss 0.02
WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).
- risk 0.33cvss 6.1epss 0.03
Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.
- risk 0.33cvss 6.1epss 0.03
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.
- risk 0.33cvss 6.1epss 0.02
Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.
- risk 0.33cvss 6.1epss 0.02
Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.
- risk 0.33cvss 6.1epss 0.02
Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.
- risk 0.33cvss 6.1epss 0.02
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.
- risk 0.33cvss 6.1epss 0.02
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.
- risk 0.33cvss 6.1epss 0.03
In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names.
- risk 0.33cvss 6.1epss 0.03
In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.
Page 6 of 19