WordPress — свободно распространяемая система управления содержимым сайта с открытым исходным кодом.
Релизный цикл, информация об уязвимостях
График релизов
Количество 1 928
GHSA-44qg-j3rp-67rc
Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
GHSA-4cxp-jjp3-3qpw
WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.
GHSA-4h7x-7f94-8hcj
In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js.
GHSA-4mq7-pxfh-pjjv
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.
GHSA-4qwm-vc77-jcqw
Cross-site scripting (XSS) vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the content parameter to wp-admin/post.php.
GHSA-5jv6-qv6x-6m4f
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action.
GHSA-5qr2-x7m5-m83q
Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.
GHSA-5q84-77v2-m356
In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.
GHSA-668g-gr9x-p9m2
In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.
GHSA-6f4p-6vw9-3q54
In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| GHSA-44qg-j3rp-67rc Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier. | 4% Низкий | больше 4 лет назад | |
| GHSA-4cxp-jjp3-3qpw WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723. | CVSS3: 9.8 | 7% Низкий | больше 4 лет назад |
| GHSA-4h7x-7f94-8hcj In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js. | CVSS3: 5.4 | 3% Низкий | больше 4 лет назад |
| GHSA-4mq7-pxfh-pjjv In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default. | CVSS3: 7.5 | 6% Низкий | больше 4 лет назад |
| GHSA-4qwm-vc77-jcqw Cross-site scripting (XSS) vulnerability in lembedded-video.php in the Embedded Video plugin 4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the content parameter to wp-admin/post.php. | 2% Низкий | больше 4 лет назад | |
| GHSA-5jv6-qv6x-6m4f Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action. | 1% Низкий | больше 4 лет назад | |
| GHSA-5qr2-x7m5-m83q Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt. | CVSS3: 6.1 | 3% Низкий | больше 4 лет назад |
| GHSA-5q84-77v2-m356 In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. | CVSS3: 6.1 | 3% Низкий | больше 4 лет назад |
| GHSA-668g-gr9x-p9m2 In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds. | CVSS3: 5.4 | 2% Низкий | больше 4 лет назад |
| GHSA-6f4p-6vw9-3q54 In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API. | CVSS3: 7.5 | 4% Низкий | больше 4 лет назад |
Уязвимостей на страницу