WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.
| Max Base Score | 8.8 |
| Published | 2019-10-17 |
| Updated | 2023-02-03 |
| EPSS | 0.21% |
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php.
| Max Base Score | 8.8 |
| Published | 2019-03-14 |
| Updated | 2019-03-31 |
| EPSS | 86.36% |
2 vulnerabilities found