Wordpress

Wordpress

360 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2015-7989

  • EPSS 0.29%
  • Published 22.05.2016 01:59:03
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714.

4.3

CVE-2015-5715

  • EPSS 28.52%
  • Published 22.05.2016 01:59:02
  • Last modified 12.04.2025 10:46:40

The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, ...

6.1

CVE-2015-5714

  • EPSS 30.65%
  • Published 22.05.2016 01:59:01
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.

4.3

CVE-2015-5734

  • EPSS 3.45%
  • Published 09.11.2015 11:59:06
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string.

4.3

CVE-2015-5733

  • EPSS 1.5%
  • Published 09.11.2015 11:59:05
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title.

4.3

CVE-2015-5732

  • EPSS 1.69%
  • Published 09.11.2015 11:59:04
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title.

6.8

CVE-2015-5731

  • EPSS 14.76%
  • Published 09.11.2015 11:59:03
  • Last modified 12.04.2025 10:46:40

Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests that lock a post, and consequently cause a denial of service (editing b...

5

CVE-2015-5730

  • EPSS 9.54%
  • Published 09.11.2015 11:59:01
  • Last modified 12.04.2025 10:46:40

The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the ...

7.5

CVE-2015-2213

  • EPSS 23.74%
  • Published 09.11.2015 11:59:00
  • Last modified 12.04.2025 10:46:40

SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash.

4.3

CVE-2015-3439

Exploit
  • EPSS 2.58%
  • Published 05.08.2015 10:59:00
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScr...