Debian Wordpress vulnerabilities

CVE-2022-21661 [HIGH] CVE-2022-21661: wordpress - WordPress is a free and open-source content management system written in PHP and... WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security re

CVE-2019-8942 [HIGH] CVE-2019-8942: wordpress - WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because... WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage C

CVE-2017-1001000 [HIGH] CVE-2017-1001000: wordpress - The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-pos... The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-jso

CVE-2023-2745 [MEDIUM] CVE-2023-2745: wordpress - WordPress Core is vulnerable to Directory Traversal in versions up to, and inclu... WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Si

CVE-2017-8295 [MEDIUM] CVE-2017-8295: wordpress - WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-ma... WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled S

CVE-2015-3440 [MEDIUM] CVE-2015-3440: wordpress - Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress b... Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. Scope: local bookworm: resolved (fixed in 4.2.1+dfsg-1) bullseye: resolved (fixed in 4.2.1+dfsg-1) forky: resolved

CVE-2022-21662 [HIGH] CVE-2022-21662: wordpress - WordPress is a free and open-source content management system written in PHP and... WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed

CVE-2021-29476 [CRITICAL] CVE-2021-29476: wordpress - Requests is a HTTP library written in PHP. Requests mishandles deserialization i... Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0. Scope: local bookworm: resolved (fixed in 5.5.3+dfsg1-1) bullseye: resolved (fixed in 5.5.3+dfsg1-1) forky: resolved (fixed in 5.5.3+dfsg1-1) sid: resolved

CVE-2022-4973 [MEDIUM] CVE-2022-4973: wordpress - WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored C... WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on

CVE-2017-5611 [CRITICAL] CVE-2017-5611: wordpress - SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in Wor... SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name. Scope: local bookworm: resolved (fixed in 4.7.2+dfsg-1) bullseye: resolved (fixed in 4.7.2+dfsg-1) forky:

CVE-2020-28034 [MEDIUM] CVE-2020-28034: wordpress - WordPress before 5.5.2 allows XSS associated with global variables. WordPress before 5.5.2 allows XSS associated with global variables. Scope: local bookworm: resolved (fixed in 5.5.3+dfsg1-1) bullseye: resolved (fixed in 5.5.3+dfsg1-1) forky: resolved (fixed in 5.5.3+dfsg1-1) sid: resolved (fixed in 5.5.3+dfsg1-1) trixie: resolved (fixed in 5.5.3+dfsg1-1)

CVE-2017-14723 [CRITICAL] CVE-2017-14723: wordpress - Before version 4.8.2, WordPress mishandled % characters and additional placehold... Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks. Scope: local bookworm: resolved (fixed in 4.8.2+dfsg-1) bullseye: resolved (fixed in 4.8.2+dfsg-1) forky: resolved (fixed in 4.8.2+dfsg-1) sid: resol

CVE-2017-14726 [MEDIUM] CVE-2017-14726: wordpress - Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack ... Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. Scope: local bookworm: resolved (fixed in 4.8.2+dfsg-1) bullseye: resolved (fixed in 4.8.2+dfsg-1) forky: resolved (fixed in 4.8.2+dfsg-1) sid: resolved (fixed in 4.8.2+dfsg-1) trixie: resolved (fixed in 4.8.2+dfsg-1)

CVE-2018-12895 [HIGH] CVE-2018-12895: wordpress - WordPress through 4.9.6 allows Author users to execute arbitrary code by leverag... WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilit

CVE-2021-29447 [HIGH] CVE-2021-29447: wordpress - Wordpress is an open source CMS. A user with the ability to upload files (like a... Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affect

CVE-2024-4439 [HIGH] CVE-2024-4439: wordpress - WordPress Core is vulnerable to Stored Cross-Site Scripting via user display nam... WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses

CVE-2020-11027 [MEDIUM] CVE-2020-11027: wordpress - In affected versions of WordPress, a password reset link emailed to a user does ... In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9,

CVE-2005-2612 [HIGH] CVE-2005-2612: wordpress - Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remo... Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remote attackers to execute arbitrary PHP code via the cache_lastpostdate[server] cookie. Scope: local bookworm: resolved (fixed in 1.5.2-1) bullseye: resolved (fixed in 1.5.2-1) forky: resolved (fixed in 1.5.2-1) sid: resolved (fixed in 1.5.2-1) trixie: resolved (fixed in 1.5.2-1)

CVE-2009-2762 [HIGH] CVE-2009-2762: wordpress - wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a p... wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array. Scope: local bookworm: resolved (fixed in 2.8.3-2) bullseye: resolved (fixed in 2.8.3-2)

CVE-2009-2335 [MEDIUM] CVE-2009-2335: wordpress - WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed ... WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience." Scope: local bookworm: resolved (fixe