Vulnerability & Exploit Database

Displaying entries 1 - 10 of 453 in total

Results for: wordpress Back to search

Wordpress: CVE-2018-20152: Input Validation Vulnerability

  • Severity: 5
  • Published: December 14, 2018

In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.

Wordpress: CVE-2018-20151: Information Leak / Disclosure Vulnerability

  • Severity: 5
  • Published: December 14, 2018

In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.

Wordpress: CVE-2018-20149: Deserialization of Untrusted Data Vulnerability

  • Severity: 4
  • Published: December 14, 2018

In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.

Wordpress: CVE-2018-20148: Deserialization of Untrusted Data Vulnerability

  • Severity: 8
  • Published: December 14, 2018

In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.

WordPress WP GDPR Compliance Plugin Privilege Escalation Exploit

Disclosed: November 08, 2018

The Wordpress GDPR Compliance plugin <= v1.4.2 allows unauthenticated users to set wordpress administration options by overwriting values within the database. The vulnerability is present in WordPress’s admin-ajax.php, which allows unauthorized users to trigger handlers and make configuration changes because of a failure...

Wordpress: CVE-2018-1000773: Input Validation vulnerability in thumbnail processing can result in remote code execution Vulnerability

  • Severity: 7
  • Published: September 06, 2018

WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploite...