WordPress — свободно распространяемая система управления содержимым сайта с открытым исходным кодом.

Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.

Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.

Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.

WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.

WordPress before 4.4 makes it easier for remote attackers to predict p ...

WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.

In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.

In WordPress through 4.9.2, unauthenticated attackers can cause a deni ...

In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.

WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).