CVSS: 7.5EPSS: 4%CPEs: 3EXPL: 0CVE-2019-17673 – WordPress Core < 5.2.4 - Cache Poisoning
https://notcve.org/view.php?id=CVE-2019-17673
14 Oct 2019 — WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header. WordPress versiones anteriores a 5.2.4, es vulnerable al envenenamiento de la memoria caché de peticiones JSON GET porque ciertas peticiones carecen de un encabezado Vary: Origin. Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attack... • https://blog.wpscan.org/wordpress/security/release/2019/10/15/wordpress-524-security-release-breakdown.html • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 5.4EPSS: 5%CPEs: 4EXPL: 3CVE-2019-16223 – WordPress Core < 5.2.3 - Authenticated Cross-Site Scripting via Post Previews
https://notcve.org/view.php?id=CVE-2019-16223
05 Sep 2019 — WordPress before 5.2.3 allows XSS in post previews by authenticated users. WordPress versiones anteriores a 5.2.3, permite un ataque de tipo XSS en las vistas previas de publicaciones por parte de usuarios autenticados. Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache,... • https://packetstorm.news/files/id/160745 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 2%CPEs: 4EXPL: 0CVE-2019-16217 – WordPress Core < 5.2.3 - Cross-Site Scripting via Media Uploads
https://notcve.org/view.php?id=CVE-2019-16217
05 Sep 2019 — WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. WordPress versiones anteriores a 5.2.3, permite un ataque de tipo XSS en cargas multimedia porque wp_ajax_upload_attachment es manejado inapropiadamente. Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, cr... • https://core.trac.wordpress.org/changeset/45936 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 2%CPEs: 4EXPL: 0CVE-2019-16218 – WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments
https://notcve.org/view.php?id=CVE-2019-16218
05 Sep 2019 — WordPress before 5.2.3 allows XSS in stored comments. WordPress versiones anteriores a 5.2.3, permite un ataque de tipo XSS en los comentarios almacenados. Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache, and bypass authorization access and input sanitation. • https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 4%CPEs: 4EXPL: 0CVE-2019-16219 – WordPress Core < 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews
https://notcve.org/view.php?id=CVE-2019-16219
05 Sep 2019 — WordPress before 5.2.3 allows XSS in shortcode previews. WordPress versiones anteriores a 5.2.3, permite un ataque de tipo XSS en las vistas previas de shortcode. Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache, and bypass authorization access and input sanitation. • https://fortiguard.com/zeroday/FG-VD-18-165 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2019-16220 – WordPress Core < 5.2.3 - Open Redirect
https://notcve.org/view.php?id=CVE-2019-16220
05 Sep 2019 — In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect. En WordPress versiones anteriores a 5.2.3, la comprobación y el saneamiento de una URL en la función wp_validate_redirect en el archivo wp-includes/pluggable.php podría conllevar a un redireccionamiento abierto. In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if ... • https://core.trac.wordpress.org/changeset/45971 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 2%CPEs: 4EXPL: 0CVE-2019-16221 – WordPress Core < 5.2.3 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-16221
05 Sep 2019 — WordPress before 5.2.3 allows reflected XSS in the dashboard. WordPress versiones anteriores a 5.2.3, permite un ataque de tipo XSS reflejado en el dashboard. Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perform various Cross-Side Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks, create files on the server, disclose private information, create open redirects, poison cache, and bypass authorization access and input sanitation. • https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 2%CPEs: 4EXPL: 1CVE-2019-16222 – WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments via URLs
https://notcve.org/view.php?id=CVE-2019-16222
05 Sep 2019 — WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks. WordPress versiones anteriores a 5.2.3, presenta un problema con el saneamiento de la URL en la función wp_kses_bad_protocol_once en el archivo wp-includes/kses.php, lo que puede conllevar a ataques de tipo cross-site scripting (XSS). Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perfo... • https://core.trac.wordpress.org/changeset/45997 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.6EPSS: 87%CPEs: 1EXPL: 7CVE-2019-9787 – WordPress Core < 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments
https://notcve.org/view.php?id=CVE-2019-9787
14 Mar 2019 — WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php. WordPress, en versiones anteriores a la 5.1.... • https://github.com/dexXxed/CVE-2019-9787 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 91%CPEs: 11EXPL: 11CVE-2019-8942 – WordPress Core < 5.0.1 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-8942
19 Feb 2019 — WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943. WordPress, en versiones anteriores a la 4.99 y en las 5.x anteriores a la 5.0.1, permite la ejecución remota de código debido a qu... • https://packetstorm.news/files/id/152396 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-434: Unrestricted Upload of File with Dangerous Type •