Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string.
| Max Base Score | 4.3 |
| Published | 2015-11-09 |
| Updated | 2017-11-04 |
| EPSS | 1.33% |
Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title.
| Max Base Score | 4.3 |
| Published | 2015-11-09 |
| Updated | 2017-09-21 |
| EPSS | 0.71% |
Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title.
| Max Base Score | 4.3 |
| Published | 2015-11-09 |
| Updated | 2017-11-04 |
| EPSS | 1.33% |
Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.
| Max Base Score | 3.5 |
| Published | 2015-08-03 |
| Updated | 2017-11-04 |
| EPSS | 0.42% |
Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.
| Max Base Score | 4.3 |
| Published | 2015-08-03 |
| Updated | 2016-12-06 |
| EPSS | 94.66% |
Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.
| Max Base Score | 4.3 |
| Published | 2015-08-05 |
| Updated | 2016-12-06 |
| EPSS | 0.56% |
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment.
| Max Base Score | 4.3 |
| Published | 2015-08-05 |
| Updated | 2016-12-06 |
| EPSS | 2.76% |
7 vulnerabilities found