Vulnerabilities > Wordpress > Wordpress > 4.9.24

DATE CVE VULNERABILITY TITLE RISK
2019-09-11 CVE-2019-16217 Cross-site Scripting vulnerability in multiple products
WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.
network
low complexity
wordpress debian CWE-79
6.1
6.1
2019-03-14 CVE-2019-9787 Cross-Site Request Forgery (CSRF) vulnerability in Wordpress
WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration.
network
low complexity
wordpress CWE-352
8.8
8.8
2019-02-20 CVE-2019-8943 Path Traversal vulnerability in Wordpress
WordPress through 5.0.3 allows Path Traversal in wp_crop_image().
network
low complexity
wordpress CWE-22
6.5
6.5
2018-11-16 CVE-2018-19296 PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack. 8.8
8.8