4.5.22

DATE	CVE	VULNERABILITY TITLE	RISK
2017-01-05	CVE-2016-7169	Path Traversal vulnerability in Wordpress Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter. network low complexity wordpress CWE-22	6.3
2017-01-05	CVE-2016-7168	Cross-site Scripting vulnerability in Wordpress Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename. network low complexity wordpress CWE-79	4.8
2016-12-30	CVE-2016-10045	Command Injection vulnerability in multiple products The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. network low complexity phpmailer-project wordpress joomla CWE-77 critical	9.8
2016-12-30	CVE-2016-10033	Argument Injection or Modification vulnerability in multiple products The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property. network low complexity phpmailer-project wordpress joomla CWE-88 critical	9.8