CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16218 – WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments
https://notcve.org/view.php?id=CVE-2019-16218
05 Sep 2019 — WordPress before 5.2.3 allows XSS in stored comments. WordPress versiones anteriores a 5.2.3, permite un ataque de tipo XSS en los comentarios almacenados. Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache, and bypass authorization access and input sanitation. • https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16219 – WordPress Core < 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews
https://notcve.org/view.php?id=CVE-2019-16219
05 Sep 2019 — WordPress before 5.2.3 allows XSS in shortcode previews. WordPress versiones anteriores a 5.2.3, permite un ataque de tipo XSS en las vistas previas de shortcode. Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache, and bypass authorization access and input sanitation. • https://fortiguard.com/zeroday/FG-VD-18-165 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16220 – WordPress Core < 5.2.3 - Open Redirect
https://notcve.org/view.php?id=CVE-2019-16220
05 Sep 2019 — In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect. En WordPress versiones anteriores a 5.2.3, la comprobación y el saneamiento de una URL en la función wp_validate_redirect en el archivo wp-includes/pluggable.php podría conllevar a un redireccionamiento abierto. In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if ... • https://core.trac.wordpress.org/changeset/45971 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16221 – WordPress Core < 5.2.3 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-16221
05 Sep 2019 — WordPress before 5.2.3 allows reflected XSS in the dashboard. WordPress versiones anteriores a 5.2.3, permite un ataque de tipo XSS reflejado en el dashboard. Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache, and bypass authorization access and input sanitation. • https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 1CVE-2019-16222 – WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments via URLs
https://notcve.org/view.php?id=CVE-2019-16222
05 Sep 2019 — WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks. WordPress versiones anteriores a 5.2.3, presenta un problema con el saneamiento de la URL en la función wp_kses_bad_protocol_once en el archivo wp-includes/kses.php, lo que puede conllevar a ataques de tipo cross-site scripting (XSS). Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perfo... • https://core.trac.wordpress.org/changeset/45997 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 3CVE-2019-16223 – WordPress Core < 5.2.3 - Authenticated Cross-Site Scripting via Post Previews
https://notcve.org/view.php?id=CVE-2019-16223
05 Sep 2019 — WordPress before 5.2.3 allows XSS in post previews by authenticated users. WordPress versiones anteriores a 5.2.3, permite un ataque de tipo XSS en las vistas previas de publicaciones por parte de usuarios autenticados. Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache,... • https://packetstorm.news/files/id/160745 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.6EPSS: 22%CPEs: 1EXPL: 7CVE-2019-9787 – WordPress Core < 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments
https://notcve.org/view.php?id=CVE-2019-9787
14 Mar 2019 — WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php. WordPress, en versiones anteriores a la 5.1.... • https://github.com/dexXxed/CVE-2019-9787 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 80%CPEs: 1EXPL: 11CVE-2019-8943 – WordPress Core <= 5.0.3 - Path Traversal and Local File Inclusion
https://notcve.org/view.php?id=CVE-2019-8943
19 Feb 2019 — WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring. WordPress hasta la versión 5.0.3 permite saltos de directorio en wp_crop_image(). • https://packetstorm.news/files/id/161213 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 8.8EPSS: 86%CPEs: 11EXPL: 11CVE-2019-8942 – WordPress Core < 5.0.1 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-8942
19 Feb 2019 — WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943. WordPress, en versiones anteriores a la 4.99 y en las 5.x anteriores a la 5.0.1, permite la ejecución remota de código debido a qu... • https://packetstorm.news/files/id/152396 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 0CVE-2018-20147 – WordPress Core < 5.0.1 - Arbitrary File Deletion
https://notcve.org/view.php?id=CVE-2018-20147
12 Dec 2018 — In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files. En WordPress, en versiones anteriores a la 4.9.9 y versiones 5.x anteriores a la 5.0.1, los autores podrían modificar metadatos para omitir las restricciones planeadas de la eliminación de archivos. Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and PHP injections attacks, delet... • http://www.securityfocus.com/bid/106220 • CWE-285: Improper Authorization CWE-863: Incorrect Authorization •