Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

wordpress wordpress 3.8 vulnerabilities and exploits

(subscribe to this query)
5
CVSSv2
CVE-2017-14719
Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.
Wordpress Wordpress 4.7.1Wordpress Wordpress 4.7.2Wordpress Wordpress 4.6.6Wordpress Wordpress 4.6.5Wordpress Wordpress 4.6.4Wordpress Wordpress 4.5.7Wordpress Wordpress 4.5.6Wordpress Wordpress 4.5Wordpress Wordpress 4.4.9Wordpress Wordpress 4.4.11Wordpress Wordpress 4.4.10Wordpress Wordpress 4.3.5Wordpress Wordpress 4.3.4Wordpress Wordpress 4.3Wordpress Wordpress 4.2.9Wordpress Wordpress 4.2.16Wordpress Wordpress 4.2.15Wordpress Wordpress 4.2Wordpress Wordpress 4.1.9Wordpress Wordpress 4.1.2Wordpress Wordpress 4.1.19Wordpress Wordpress 4.1.11
5
CVSSv2
CVE-2014-5266
The Incutio XML-RPC (IXR) Library, as used in WordPress prior to 3.9.2 and Drupal 6.x prior to 6.33 and 7.x prior to 7.31, does not limit the number of elements in an XML document, which allows remote malicious users to cause a denial of service (CPU consumption) via a large docu...
Wordpress Wordpress 3.0Wordpress Wordpress 3.0.1Wordpress Wordpress 3.0.2Wordpress Wordpress 3.0.3Wordpress Wordpress 3.3.1Wordpress Wordpress 3.3.2Wordpress Wordpress 3.3.3Wordpress Wordpress 3.4.0Wordpress Wordpress 3.0.4Wordpress Wordpress 3.0.6Wordpress Wordpress 3.2Wordpress Wordpress 3.3Wordpress Wordpress 3.4.1Wordpress Wordpress 3.5.0Wordpress Wordpress 3.8.1Wordpress WordpressWordpress Wordpress 3.1.1Wordpress Wordpress 3.1.2Wordpress Wordpress 3.1.3Wordpress Wordpress 3.1.4Wordpress Wordpress 3.6Wordpress Wordpress 3.6.1
5
CVSSv2
CVE-2014-5265
The Incutio XML-RPC (IXR) Library, as used in WordPress prior to 3.9.2 and Drupal 6.x prior to 6.33 and 7.x prior to 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote malicious users to cause a denial of service (memory a...
Wordpress Wordpress 3.0Wordpress Wordpress 3.0.1Wordpress Wordpress 3.0.2Wordpress Wordpress 3.3.1Wordpress Wordpress 3.3.2Wordpress Wordpress 3.3.3Wordpress Wordpress 3.4.0Wordpress Wordpress 3.1Wordpress Wordpress 3.1.1Wordpress Wordpress 3.1.2Wordpress Wordpress 3.1.3Wordpress Wordpress 3.1.4Wordpress Wordpress 3.6Wordpress Wordpress 3.6.1Wordpress Wordpress 3.7Wordpress Wordpress 3.7.1Wordpress Wordpress 3.0.4Wordpress Wordpress 3.0.6Wordpress Wordpress 3.2Wordpress Wordpress 3.3Wordpress Wordpress 3.4.1Wordpress Wordpress 3.5.0
5.5
CVSSv2
CVE-2018-20147
In WordPress prior to 4.9.9 and 5.x prior to 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.
Wordpress WordpressDebian Debian Linux 9.0Debian Debian Linux 8.0
3.5
CVSSv2
CVE-2018-20149
In WordPress prior to 4.9.9 and 5.x prior to 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
Wordpress WordpressDebian Debian Linux 9.0Debian Debian Linux 8.0
4.3
CVSSv2
CVE-2018-20150
In WordPress prior to 4.9.9 and 5.x prior to 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
Wordpress WordpressDebian Debian Linux 8.0Debian Debian Linux 9.0
5
CVSSv2
CVE-2018-20151
In WordPress prior to 4.9.9 and 5.x prior to 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was...
Wordpress WordpressDebian Debian Linux 9.0Debian Debian Linux 8.0
4
CVSSv2
CVE-2018-20152
In WordPress prior to 4.9.9 and 5.x prior to 5.0.1, authors could bypass intended restrictions on post types via crafted input.
Wordpress WordpressDebian Debian Linux 8.0Debian Debian Linux 9.0
3.5
CVSSv2
CVE-2018-20153
In WordPress prior to 4.9.9 and 5.x prior to 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.
Wordpress WordpressDebian Debian Linux 8.0Debian Debian Linux 9.0
7.5
CVSSv2
CVE-2018-20148
In WordPress prior to 4.9.9 and 5.x prior to 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-i...
Wordpress WordpressDebian Debian Linux 8.0Debian Debian Linux 9.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-1183hard-codedCVE-2024-28254CVE-2023-43790buffer overflowbypassCVE-2024-32633CVE-2024-1874CVE-2024-23558
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook