CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36872 – WordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2021-36872
04 Jul 2021 — Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3). Vulnerable at &widget-wpp[2][post_type]. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) Persistente Autenticado en el plugin Popular Posts de WordPress (versiones anteriores a 5.3.3, incluyéndola). Vulnerable en &widget-wpp[2][post_type] • https://github.com/cabrerahector/wordpress-popular-posts/blob/master/changelog.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20746 – WordPress Popular Posts <= 5.3.2 - Authenticated Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-20746
23 Jun 2021 — Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. Una vulnerabilidad de tipo cross-site scripting en WordPress Popular Posts versiones 5.3.2 y anteriores, permite a un atacante remoto autenticado inyectar un script arbitrario por medio de vectores no especificados • https://cabrerahector.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 22EXPL: 0CVE-2020-36326
https://notcve.org/view.php?id=CVE-2020-36326
28 Apr 2021 — PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exploitation. PHPMailer versión 6.1.8 hasta la versión 6.4.0 permite la inyección de objetos a través de Phar Deser... • https://github.com/PHPMailer/PHPMailer/commit/e2e07a355ee8ff36aba21d0242c5950c56e4c6f9 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.1EPSS: 85%CPEs: 3EXPL: 21CVE-2021-29447 – WordPress Authenticated XXE attack when installation is running PHP 8
https://notcve.org/view.php?id=CVE-2021-29447
15 Apr 2021 — Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. • https://packetstorm.news/files/id/163148 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.5EPSS: 1%CPEs: 3EXPL: 0CVE-2021-29450 – WordPress Authenticated disclosure of password-protected posts and pages
https://notcve.org/view.php?id=CVE-2021-29450
15 Apr 2021 — Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix. • https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-pmmh-2f36-wvhq • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.0EPSS: 90%CPEs: 6EXPL: 16CVE-2022-21661 – SQL injection in WordPress
https://notcve.org/view.php?id=CVE-2022-21661
06 Jan 2021 — WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. • https://packetstorm.news/files/id/165540 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 2%CPEs: 3EXPL: 0CVE-2021-29476 – Insecure Deserialization of untrusted data in rmccue/requests
https://notcve.org/view.php?id=CVE-2021-29476
29 Oct 2020 — Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0. Requests es una biblioteca HTTP escrita en PHP. Las peticiones manejan inapropiadamente una deserialización en FilteredIterator. • https://github.com/WordPress/Requests/security/advisories/GHSA-52qp-jpq7-6c54 • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.4EPSS: 16%CPEs: 6EXPL: 0CVE-2020-28038 – WordPress Core < 5.5.2 - Stored Cross-Site Scripting via post slugs
https://notcve.org/view.php?id=CVE-2020-28038
29 Oct 2020 — WordPress before 5.5.2 allows stored XSS via post slugs. WordPress versiones anteriores a 5.5.2, permite un ataque de tipo XSS almacenado por medio de slugs de publicaciones Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to run insecure deserialization, embed spam, perform various Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks, escalate privileges, run arbitrary code, and delete arbitrary files. • https://blog.ripstech.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2020-28040 – WordPress Core < 5.5.2 - Cross-Site Request Forgery to Theme Image Change
https://notcve.org/view.php?id=CVE-2020-28040
29 Oct 2020 — WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. WordPress versiones anteriores a 5.5.2, permite ataques de tipo CSRF que cambian la imagen de fondo del tema Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to run insecure deserialization, embed spam, perform various Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks, escalate privileges, run arbitrary code, and delete arbitrary files. • https://blog.wpscan.com/2020/10/30/wordpress-5.5.2-security-release.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 2%CPEs: 6EXPL: 0CVE-2020-28034 – WordPress Core < 5.5.2 - Reflected Cross-Site Scripting via Global Variables
https://notcve.org/view.php?id=CVE-2020-28034
29 Oct 2020 — WordPress before 5.5.2 allows XSS associated with global variables. WordPress versiones anteriores a 5.5.2, permite un ataque de tipo XSS asociado con variables globales Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to run insecure deserialization, embed spam, perform various Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF) attacks, escalate privileges, run arbitrary code, and delete arbitrary files. • https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •