WordPress — свободно распространяемая система управления содержимым сайта с открытым исходным кодом.
Релизный цикл, информация об уязвимостях
График релизов
Количество 1 896
CVE-2016-5834
Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.
CVE-2016-5833
Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834.
CVE-2016-4567
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
CVE-2016-4567
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as ...
CVE-2016-4566
Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.
CVE-2016-4566
Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plup ...
CVE-2016-2222
The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.
CVE-2016-2222
The wp_http_validate_url function in wp-includes/http.php in WordPress ...
CVE-2016-2221
Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.
CVE-2016-2221
Open redirect vulnerability in the wp_validate_redirect function in wp ...
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2016-5834 Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833. | CVSS3: 6.1 | 1% Низкий | больше 9 лет назад |
| CVE-2016-5833 Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834. | CVSS3: 6.1 | 1% Низкий | больше 9 лет назад |
 | CVE-2016-4567 Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn." | CVSS3: 6.1 | 4% Низкий | больше 9 лет назад |
| CVE-2016-4567 Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as ... | CVSS3: 6.1 | 4% Низкий | больше 9 лет назад |
| CVE-2016-4566 Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack. | CVSS3: 6.1 | 6% Низкий | больше 9 лет назад |
| CVE-2016-4566 Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plup ... | CVSS3: 6.1 | 6% Низкий | больше 9 лет назад |
| CVE-2016-2222 The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php. | CVSS3: 8.6 | 5% Низкий | больше 9 лет назад |
| CVE-2016-2222 The wp_http_validate_url function in wp-includes/http.php in WordPress ... | CVSS3: 8.6 | 5% Низкий | больше 9 лет назад |
| CVE-2016-2221 Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL. | CVSS3: 7.4 | 3% Низкий | больше 9 лет назад |
| CVE-2016-2221 Open redirect vulnerability in the wp_validate_redirect function in wp ... | CVSS3: 7.4 | 3% Низкий | больше 9 лет назад |
Уязвимостей на страницу