In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.
Max CVSS
7.5
EPSS Score
1.03%
Published
2018-12-14
Updated
2019-03-04
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
Max CVSS
7.5
EPSS Score
0.57%
Published
2016-06-29
Updated
2016-11-30
2 vulnerabilities found