Vulnerabilities > Wordpress > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-03-12 | CVE-2017-6816 | Incorrect Authorization vulnerability in multiple products In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality. | 4.9 |
| 2017-03-12 | CVE-2017-6815 | Improper Input Validation vulnerability in multiple products In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. | 6.1 |
| 2017-03-12 | CVE-2017-6814 | Cross-site Scripting vulnerability in multiple products In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. | 5.4 |
| 2017-01-30 | CVE-2017-5612 | Cross-site Scripting vulnerability in multiple products Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt. | 6.1 |
| 2017-01-30 | CVE-2017-5610 | Information Exposure vulnerability in multiple products wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms. | 5.3 |
| 2017-01-18 | CVE-2016-6897 | Cross-Site Request Forgery (CSRF) vulnerability in Wordpress Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896. | 6.5 |
| 2017-01-18 | CVE-2016-10148 | Improper Access Control vulnerability in Wordpress The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896. | 4.3 |
| 2017-01-15 | CVE-2017-5491 | Insecure Default Initialization of Resource vulnerability in Wordpress wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name. | 5.3 |
| 2017-01-15 | CVE-2017-5490 | Cross-site Scripting vulnerability in Wordpress Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php. | 6.1 |
| 2017-01-15 | CVE-2017-5488 | Cross-site Scripting vulnerability in Wordpress Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin. | 6.1 |