WordPress — свободно распространяемая система управления содержимым сайта с открытым исходным кодом.

Релизный цикл, информация об уязвимостях

Продукт: WordPress

Вендор: Wordpress

График релизов

Недавние уязвимости WordPress

Количество 1 928

CVE-2011-0700

больше 15 лет назад

Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, and (5) escaping of tags within the tags meta box.

CVSS2: 3.5

EPSS: Низкий

CVE-2010-4747

больше 15 лет назад

Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pluginurl parameter.

CVSS2: 4.3

EPSS: Низкий

CVE-2011-1047

больше 15 лет назад

Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) search_max parameter in a search action to index.php, which is not properly handled by wpf.class.php, (2) id parameter in an editpost action to index.php, which is not properly handled by wpf-post.php, or (3) topic parameter to feed.php.

CVSS2: 7.5

EPSS: Низкий

CVE-2011-0740

почти 16 лет назад

Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in RSS Feed Reader 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.

CVSS2: 4.3

EPSS: Низкий

CVE-2011-0740

почти 16 лет назад

Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slas ...

CVSS2: 4.3

EPSS: Низкий

CVE-2011-0740

почти 16 лет назад

CVSS2: 4.3

EPSS: Низкий

CVE-2011-0641

почти 16 лет назад

Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) what1, (2) what2, (3) what3, (4) what4, and (5) what5 parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CVSS2: 4.3

EPSS: Низкий

CVE-2010-4536

почти 16 лет назад

Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form.

CVSS2: 4.3

EPSS: Низкий

CVE-2010-4536

почти 16 лет назад

Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used i ...

CVSS2: 4.3

EPSS: Низкий

CVE-2010-4536

почти 16 лет назад

CVSS2: 4.3

EPSS: Низкий

Уязвимостей на страницу

Уязвимость	CVSS	EPSS	Опубликовано 1
CVE-2011-0700 Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, and (5) escaping of tags within the tags meta box.	CVSS2: 3.5	3% Низкий	больше 15 лет назад
CVE-2010-4747 Cross-site scripting (XSS) vulnerability in wordpress-processing-embed/data/popup.php in the Processing Embed plugin 0.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pluginurl parameter.	CVSS2: 4.3	4% Низкий	больше 15 лет назад
CVE-2011-1047 Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) search_max parameter in a search action to index.php, which is not properly handled by wpf.class.php, (2) id parameter in an editpost action to index.php, which is not properly handled by wpf-post.php, or (3) topic parameter to feed.php.	CVSS2: 7.5	5% Низкий	больше 15 лет назад
CVE-2011-0740 Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in RSS Feed Reader 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.	CVSS2: 4.3	5% Низкий	почти 16 лет назад
CVE-2011-0740 Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slas ...	CVSS2: 4.3	5% Низкий	почти 16 лет назад
CVE-2011-0740 Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in RSS Feed Reader 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.	CVSS2: 4.3	5% Низкий	почти 16 лет назад
CVE-2011-0641 Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) what1, (2) what2, (3) what3, (4) what4, and (5) what5 parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.	CVSS2: 4.3	2% Низкий	почти 16 лет назад
CVE-2010-4536 Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form.	CVSS2: 4.3	3% Низкий	почти 16 лет назад
CVE-2010-4536 Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used i ...	CVSS2: 4.3	3% Низкий	почти 16 лет назад
CVE-2010-4536 Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form.	CVSS2: 4.3	3% Низкий	почти 16 лет назад

Уязвимостей на страницу