WordPress — свободно распространяемая система управления содержимым сайта с открытым исходным кодом.
Релизный цикл, информация об уязвимостях
График релизов
Количество 1 928
CVE-2018-20153
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could mod ...
CVE-2018-20151
In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation pa ...
CVE-2018-20147
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify m ...
CVE-2018-20148
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could con ...
CVE-2018-20152
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass i ...
CVE-2018-20152
In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.
CVE-2018-20148
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.
CVE-2018-20149
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
CVE-2018-20150
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
CVE-2018-20153
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| CVE-2018-20153 In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could mod ... | CVSS3: 5.4 | 2% Низкий | почти 8 лет назад |
| CVE-2018-20151 In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation pa ... | CVSS3: 7.5 | 6% Низкий | почти 8 лет назад |
| CVE-2018-20147 In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify m ... | CVSS3: 6.5 | 3% Низкий | почти 8 лет назад |
| CVE-2018-20148 In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could con ... | CVSS3: 9.8 | 27% Средний | почти 8 лет назад |
| CVE-2018-20152 In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass i ... | CVSS3: 6.5 | 4% Низкий | почти 8 лет назад |
 | CVE-2018-20152 In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input. | CVSS3: 6.5 | 4% Низкий | почти 8 лет назад |
| CVE-2018-20148 In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php. | CVSS3: 9.8 | 27% Средний | почти 8 лет назад |
| CVE-2018-20149 In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data. | CVSS3: 5.4 | 3% Низкий | почти 8 лет назад |
| CVE-2018-20150 In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins. | CVSS3: 6.1 | 4% Низкий | почти 8 лет назад |
| CVE-2018-20153 In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS. | CVSS3: 5.4 | 2% Низкий | почти 8 лет назад |
Уязвимостей на страницу