Rapid7 Vulnerability & Exploit Database

FreeBSD: VID-8A9F86DE-D080-11E9-9051-4C72B94353B5: wordpress -- multiple issues

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

FreeBSD: VID-8A9F86DE-D080-11E9-9051-4C72B94353B5: wordpress -- multiple issues

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
09/05/2019
Created
09/09/2019
Added
09/07/2019
Modified
11/13/2019

Description

wordpress developers reports:

Props to Simon Scannell of RIPS Technologies for finding and disclosing two issues.

The first, a cross-site scripting (XSS) vulnerability found in post previews by contributors.

The second was a cross-site scripting vulnerability in stored comments.

Props to Tim Coen for disclosing an issue where validation and sanitization

of a URL could lead to an open redirect.

Props to Anshul Jain for disclosing reflected cross-site scripting during media uploads.

Props to Zhouyuan Yang of Fortinets FortiGuard Labs who disclosed a vulnerability

for cross-site scripting (XSS) in shortcode previews.

Props to Ian Dunn of the Core Security Team for finding and disclosing a case where

reflected cross-site scripting could be found in the dashboard.

Props to Soroush Dalilifrom NCC Group for disclosing an issue with URL

sanitization that can lead to cross-site scripting (XSS) attacks.

In addition to the above changes, we are also updating jQuery on older versions of WordPress.

This change was added in 5.2.1 and is now being brought to older versions.

Solution(s)

  • freebsd-upgrade-package-de-wordpress
  • freebsd-upgrade-package-fr-wordpress
  • freebsd-upgrade-package-ja-wordpress
  • freebsd-upgrade-package-ru-wordpress
  • freebsd-upgrade-package-wordpress
  • freebsd-upgrade-package-zh_cn-wordpress
  • freebsd-upgrade-package-zh_tw-wordpress

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;