wordpress wordpress 4.7 vulnerabilities and exploits

(subscribe to this query)

7.5

CVSSv3

The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x prior to 4.7.2 does not require an integer identifier, which allows remote malicious users to modify arbitrary pages via a request for wp-json/wp/v...

Wordpress Wordpress 4.7.1 Wordpress Wordpress 4.7 Wordpress Wordpress 4.7.2

1 Nmap script3 Github repositories

7.5

CVSSv3

Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.

Wordpress Wordpress 4.7.5 Wordpress Wordpress 4.8 Wordpress Wordpress 4.7.3 Wordpress Wordpress 4.7.4 Wordpress Wordpress 4.7 Wordpress Wordpress 4.8.1 Wordpress Wordpress 4.7.1 Wordpress Wordpress 4.7.2

5.3

CVSSv3

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 prior to 4.7.1 does not properly restrict listings of post authors, which allows remote malicious users to obtain sensitive information via a wp-json/wp/v2/users requ...

Wordpress Wordpress

1 EDB exploit21 Github repositories

4.3

CVSSv3

Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 up to and including 6.3.1, from 6.2 up to and including 6.2.2, from 6.1 up to and including 6.13, from 6.0 up to and including 6.0.5, from 5.9 up to and including 5.9.7, from 5.8 up to and including ...

Wordpress Wordpress Fedoraproject Fedora 37 Fedoraproject Fedora 38

NA

Cross-site request forgery (CSRF) vulnerability in the Facebook Members plugin prior to 5.0.5 for WordPress allows remote malicious users to hijack the authentication of administrators for requests that modify this plugin's settings.

Crunchify Facebook Members 5.0 Crunchify Facebook Members 4.7 Crunchify Facebook Members 4.6.1 Crunchify Facebook Members 4.6 Crunchify Facebook Members 4.5.3 Crunchify Facebook Members Crunchify Facebook Members 5.0.2 Crunchify Facebook Members 5.0.3 Crunchify Facebook Members 5.0.1

9.8

CVSSv3

The search-everything plugin prior to 8.1.7 for WordPress has SQL injection related to WordPress 4.7.x, a different vulnerability than CVE-2014-2316.

Search Everything Project Search Everything

NA

Cross-site scripting (XSS) vulnerability in library/includes/payment/paypalexpress/DoDirectPayment.php in the Spotlight (spotlightyour) plugin 4.7 and previous versions for WordPress allows remote malicious users to inject arbitrary web script or HTML via the paymentType paramete...

Spotlightyour Spotlightyour

8.8

CVSSv3

The St-Daily-Tip WordPress plugin up to and including 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow malicious ...

Sanskruti St-daily-tip

8.8

CVSSv3

The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7. This is due to missing nonce validation in the ~/includes/settings.php file. This makes it possible for unauthenticated malicious users to modify the...

Superwhite Demon Image Annotation

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook