WordPress — свободно распространяемая система управления содержимым сайта с открытым исходным кодом.
Релизный цикл, информация об уязвимостях
График релизов
Количество 1 928
CVE-2015-3438
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment.
CVE-2015-3438
Multiple cross-site scripting (XSS) vulnerabilities in WordPress befor ...
CVE-2015-3439
Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiec ...
CVE-2015-3438
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment.
CVE-2015-3439
Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.
CVE-2015-3440
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.
CVE-2015-5623
WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.
CVE-2015-5622
Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.
CVE-2015-3440
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in W ...
CVE-2015-5622
Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 all ...
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2015-3438 Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment. | CVSS2: 4.3 | 7% Низкий | больше 11 лет назад |
| CVE-2015-3438 Multiple cross-site scripting (XSS) vulnerabilities in WordPress befor ... | CVSS2: 4.3 | 7% Низкий | больше 11 лет назад |
| CVE-2015-3439 Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiec ... | CVSS2: 4.3 | 5% Низкий | больше 11 лет назад |
 | CVE-2015-3438 Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment. | CVSS2: 4.3 | 7% Низкий | больше 11 лет назад |
| CVE-2015-3439 Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as. | CVSS2: 4.3 | 5% Низкий | больше 11 лет назад |
| CVE-2015-3440 Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. | CVSS2: 4.3 | 17% Средний | больше 11 лет назад |
| CVE-2015-5623 WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php. | CVSS2: 4 | 8% Низкий | больше 11 лет назад |
| CVE-2015-5622 Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php. | CVSS2: 3.5 | 5% Низкий | больше 11 лет назад |
| CVE-2015-3440 Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in W ... | CVSS2: 4.3 | 17% Средний | больше 11 лет назад |
| CVE-2015-5622 Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 all ... | CVSS2: 3.5 | 5% Низкий | больше 11 лет назад |
Уязвимостей на страницу