Latest Wordpress Wordpress 4 2 8 Security Vulnerabilities

DATE CVE VULNERABILITY TITLE RISK
2016-06-29 CVE-2016-5832 Unspecified vulnerability in Wordpress
The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors.
network
low complexity
wordpress
nessus
5.0
2016-05-22 CVE-2016-4567 Cross-Site Scripting vulnerability in multiple products
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
4.3
2016-05-22 CVE-2016-4566 Cross-Site Scripting vulnerability in Wordpress
Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.
4.3
2016-05-22 CVE-2016-2221 Unspecified vulnerability in Wordpress
Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.
network
wordpress
nessus
5.8
2016-05-22 CVE-2016-1564 Cross-Site Scripting vulnerability in Wordpress
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php.
network
wordpress
CWE-79
nessus
4.3
2016-05-22 CVE-2015-7989 Cross-Site Scripting vulnerability in Wordpress
Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714.
network
wordpress
CWE-79
nessus
3.5
2016-05-22 CVE-2015-5715 Permissions, Privileges, and Access Controls vulnerability in Wordpress
The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.
network
low complexity
wordpress
CWE-264
nessus
4.0
2016-05-22 CVE-2015-5714 Cross-Site Scripting vulnerability in Wordpress
Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.
network
wordpress
CWE-79
nessus
4.3