WordPress Vulnerabilities

Published
Title
Published
2018-02-05
Title
WordPress <= 4.9.4 - Application Denial of Service (DoS) (unpatched)
Published
2018-01-17
Title
WordPress 3.7-4.9.1 - MediaElement Cross-Site Scripting (XSS)
Published
2017-11-29
Title
WordPress 3.7-4.9 - 'newbloguser' Key Weak Hashing
Published
2017-11-29
Title
WordPress 4.3.0-4.9 - HTML Language Attribute Escaping
Published
2017-11-29
Title
WordPress 1.5.0-4.9 - RSS and Atom Feed Escaping
Published
2017-11-29
Title
WordPress 2.8.6-4.9 - Authenticated JavaScript File Upload
Published
2017-10-31
Title
WordPress <= 4.8.2 - $wpdb->prepare() Weakness
Published
2017-09-20
Title
WordPress 3.0-4.8.1 - Path Traversal in Unzipping
Published
2017-09-20
Title
WordPress 2.9.2-4.8.1 - Open Redirect
Published
2017-09-19
Title
WordPress 4.2.3-4.8.1 - Authenticated Cross-Site Scripting (XSS) in Visual Editor
Published
2017-09-19
Title
WordPress 4.4-4.8.1 - Cross-Site Scripting (XSS) in oEmbed
Published
2017-09-19
Title
WordPress 4.4-4.8.1 - Path Traversal in Customizer
Published
2017-09-19
Title
WordPress 2.3.0-4.8.1 - $wpdb->prepare() potential SQL Injection
Published
2017-08-24
Title
WordPress 2.3.0-4.7.4 - Authenticated SQL injection
Published
2017-05-16
Title
WordPress 3.4.0-4.7.4 - Customizer XSS & CSRF
Published
2017-05-16
Title
WordPress 3.3-4.7.4 - Large File Upload Error XSS
Published
2017-05-16
Title
WordPress 2.5.0-4.7.4 - Filesystem Credentials Dialog CSRF
Published
2017-05-16
Title
WordPress 3.4.0-4.7.4 - XML-RPC Post Meta Data Lack of Capability Checks
Published
2017-05-16
Title
WordPress 2.5.0-4.7.4 - Post Meta Data Values Improper Handling in XML-RPC
Published
2017-05-16
Title
WordPress 2.7.0-4.7.4 - Insufficient Redirect Validation
Published
2017-05-03
Title
WordPress 2.3-4.8.3 - Host Header Injection in Password Reset
Published
2017-03-06
Title
WordPress 4.2-4.7.2 - Press This CSRF DoS
Published
2017-03-06
Title
WordPress 4.7-4.7.2 - Cross-Site Scripting (XSS) via Taxonomy Term Names
Published
2017-03-06
Title
WordPress 4.0-4.7.2 - Authenticated Stored Cross-Site Scripting (XSS) in YouTube URL Embeds
Published
2017-03-06
Title
WordPress 4.7.0-4.7.2 - Authenticated Unintended File Deletion in Plugin Delete