# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
1 |
CVE-2017-17094 |
79 |
|
XSS |
2017-12-02 |
2019-04-26 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL. |
2 |
CVE-2017-17093 |
79 |
|
XSS |
2017-12-02 |
2019-04-26 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site. |
3 |
CVE-2017-17092 |
79 |
|
XSS |
2017-12-02 |
2019-04-26 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file. |
4 |
CVE-2017-14726 |
79 |
|
XSS |
2017-09-23 |
2017-11-10 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. |
5 |
CVE-2017-14724 |
79 |
|
XSS |
2017-09-23 |
2017-11-10 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery. |
6 |
CVE-2017-14721 |
79 |
|
XSS |
2017-09-23 |
2017-11-10 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name. |
7 |
CVE-2017-14720 |
79 |
|
XSS |
2017-09-23 |
2017-11-10 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. |
8 |
CVE-2017-14718 |
79 |
|
XSS |
2017-09-23 |
2017-11-10 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. |
9 |
CVE-2017-9063 |
79 |
|
XSS |
2017-05-18 |
2019-03-15 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session. |
10 |
CVE-2017-9061 |
79 |
|
XSS |
2017-05-18 |
2019-03-15 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename. |
11 |
CVE-2017-6818 |
79 |
|
XSS |
2017-03-12 |
2019-03-19 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names. |
12 |
CVE-2017-6817 |
79 |
|
XSS |
2017-03-12 |
2019-03-19 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds. |
13 |
CVE-2017-6814 |
79 |
|
XSS |
2017-03-12 |
2019-03-19 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js. |
14 |
CVE-2017-5612 |
79 |
|
XSS |
2017-01-30 |
2019-03-19 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt. |
15 |
CVE-2017-5490 |
79 |
|
XSS |
2017-01-15 |
2017-11-04 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php. |
16 |
CVE-2017-5488 |
79 |
|
XSS |
2017-01-15 |
2017-11-04 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin. |
17 |
CVE-2016-7168 |
79 |
|
XSS |
2017-01-05 |
2017-11-04 |
3.5 |
None |
Remote |
Medium |
??? |
None |
Partial |
None |
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename. |