WordPress — свободно распространяемая система управления содержимым сайта с открытым исходным кодом.
Релизный цикл, информация об уязвимостях
График релизов
Количество 1 912
CVE-2016-4566
Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.
CVE-2016-4566
Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plup ...
CVE-2016-2222
The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.
CVE-2016-2222
The wp_http_validate_url function in wp-includes/http.php in WordPress ...
CVE-2016-2221
Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.
CVE-2016-2221
Open redirect vulnerability in the wp_validate_redirect function in wp ...
CVE-2016-1564
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php.
CVE-2016-1564
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/cla ...
CVE-2015-8834
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440.
CVE-2015-8834
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in W ...
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2016-4566 Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack. | CVSS3: 6.1 | 6% Низкий | около 10 лет назад |
| CVE-2016-4566 Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plup ... | CVSS3: 6.1 | 6% Низкий | около 10 лет назад |
| CVE-2016-2222 The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php. | CVSS3: 8.6 | 8% Низкий | около 10 лет назад |
| CVE-2016-2222 The wp_http_validate_url function in wp-includes/http.php in WordPress ... | CVSS3: 8.6 | 8% Низкий | около 10 лет назад |
| CVE-2016-2221 Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL. | CVSS3: 7.4 | 4% Низкий | около 10 лет назад |
| CVE-2016-2221 Open redirect vulnerability in the wp_validate_redirect function in wp ... | CVSS3: 7.4 | 4% Низкий | около 10 лет назад |
| CVE-2016-1564 Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php. | CVSS3: 6.1 | 3% Низкий | около 10 лет назад |
| CVE-2016-1564 Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/cla ... | CVSS3: 6.1 | 3% Низкий | около 10 лет назад |
| CVE-2015-8834 Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440. | CVSS3: 6.1 | 2% Низкий | около 10 лет назад |
| CVE-2015-8834 Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in W ... | CVSS3: 6.1 | 2% Низкий | около 10 лет назад |
Уязвимостей на страницу