WordPress — свободно распространяемая система управления содержимым сайта с открытым исходным кодом.
Релизный цикл, информация об уязвимостях
График релизов
Количество 1 928
CVE-2021-29447
Wordpress is an open source CMS. A user with the ability to upload fil ...
CVE-2021-29450
Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix.
CVE-2021-29447
Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.
BDU:2021-04579
Уязвимость системы управления содержимым сайта WordPress, связанная с раскрытием информации, позволяющая нарушителю получить доступ к конфиденциальным данным
BDU:2021-04578
Уязвимость библиотеки Media системы управления содержимым сайта WordPress, связанная с неверным ограничением XML-ссылок на внешние объекты, позволяющая нарушителю получить доступ к конфиденциальным данным
CVE-2020-28037
is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation).
CVE-2020-28036
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.
CVE-2020-28039
is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.
CVE-2020-28038
WordPress before 5.5.2 allows stored XSS via post slugs.
CVE-2020-28035
WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| CVE-2021-29447 Wordpress is an open source CMS. A user with the ability to upload fil ... | CVSS3: 6.5 | 86% Высокий | больше 5 лет назад |
 | CVE-2021-29450 Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix. | CVSS3: 4.3 | 2% Низкий | больше 5 лет назад |
| CVE-2021-29447 Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled. | CVSS3: 6.5 | 86% Высокий | больше 5 лет назад |
 | BDU:2021-04579 Уязвимость системы управления содержимым сайта WordPress, связанная с раскрытием информации, позволяющая нарушителю получить доступ к конфиденциальным данным | CVSS3: 4.3 | 2% Низкий | больше 5 лет назад |
| BDU:2021-04578 Уязвимость библиотеки Media системы управления содержимым сайта WordPress, связанная с неверным ограничением XML-ссылок на внешние объекты, позволяющая нарушителю получить доступ к конфиденциальным данным | CVSS3: 6.5 | 86% Высокий | больше 5 лет назад |
 | CVE-2020-28037 is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation). | CVSS3: 9.8 | 8% Низкий | около 6 лет назад |
| CVE-2020-28036 wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. | CVSS3: 9.8 | 5% Низкий | около 6 лет назад |
| CVE-2020-28039 is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected. | CVSS3: 9.1 | 4% Низкий | около 6 лет назад |
| CVE-2020-28038 WordPress before 5.5.2 allows stored XSS via post slugs. | CVSS3: 6.1 | 3% Низкий | около 6 лет назад |
| CVE-2020-28035 WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. | CVSS3: 9.8 | 4% Низкий | около 6 лет назад |
Уязвимостей на страницу