Debian Wordpress vulnerabilities

CVE-2014-5265 [MEDIUM] CVE-2014-5265: wordpress - The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal ... The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity referenc

CVE-2012-4448 [MEDIUM] CVE-2012-4448: wordpress - Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPre... Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard_incoming_links edit action. Scope: local bookworm: resolved (fixed in 3.5.1+dfsg-2) bullseye: resolved (fixed in 3.5.1+dfsg-2) forky: resolved (fixed in 3

CVE-2017-14718 [MEDIUM] CVE-2017-14718: wordpress - Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack... Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. Scope: local bookworm: resolved (fixed in 4.8.2+dfsg-1) bullseye: resolved (fixed in 4.8.2+dfsg-1) forky: resolved (fixed in 4.8.2+dfsg-1) sid: resolved (fixed in 4.8.2+dfsg-1) trixie: resolved (fixed in 4.8.2+dfsg-1)

CVE-2016-5833 [MEDIUM] CVE-2016-5833: wordpress - Cross-site scripting (XSS) vulnerability in the column_title function in wp-admi... Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834. Scope: local bookworm: resolved (fixed in 4.5.3+dfsg-1) bullseye: resolved (fix

CVE-2019-16219 [MEDIUM] CVE-2019-16219: wordpress - WordPress before 5.2.3 allows XSS in shortcode previews. WordPress before 5.2.3 allows XSS in shortcode previews. Scope: local bookworm: resolved (fixed in 5.2.3+dfsg1-1) bullseye: resolved (fixed in 5.2.3+dfsg1-1) forky: resolved (fixed in 5.2.3+dfsg1-1) sid: resolved (fixed in 5.2.3+dfsg1-1) trixie: resolved (fixed in 5.2.3+dfsg1-1)

CVE-2018-20153 [MEDIUM] CVE-2018-20153: wordpress - In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new co... In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS. Scope: local bookworm: resolved (fixed in 5.0.1+dfsg1-1) bullseye: resolved (fixed in 5.0.1+dfsg1-1) forky: resolved (fixed in 5.0.1+dfsg1-1) sid: resolved (fixed in 5.0.1+dfsg1-1) trixie: resolved (fixed in 5.0.1+df

CVE-2017-17094 [MEDIUM] CVE-2017-17094: wordpress - wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclos... wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL. Scope: local bookworm: resolved (fixed in 4.9.1+dfsg-1) bullseye: resolved (fixed in 4.9.1+dfsg-1) forky: resolved (fixed in 4.9.1+dfsg-1) sid: resolved (fixed in 4.9.1+dfsg-1) trixie:

CVE-2015-8834 [MEDIUM] CVE-2015-8834: wordpress - Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress b... Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440. Scope: local bookworm: resolved (f

CVE-2012-3384 [MEDIUM] CVE-2012-3384: wordpress - Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress b... Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Scope: local bookworm: resolved (fixed in 3.4.1+dfsg-1) bullseye: resolved (fixed in 3.4.1+dfsg-1) forky: resolved (fixed in 3.4.1+dfsg-1) sid: resolved (fixed in 3.4.1+dfsg-1)

CVE-2016-1564 [MEDIUM] CVE-2016-1564: wordpress - Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-them... Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php. Scope: local bookworm: resolved (fixed in 4.4.1+dfsg-1) bullseye: resolved (fixed in 4.4.1+dfsg-1) forky: resolved (fi

CVE-2017-5612 [MEDIUM] CVE-2017-5612: wordpress - Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-lis... Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt. Scope: local bookworm: resolved (fixed in 4.7.2+dfsg-1) bullseye: resolved (fixed in 4.7.2+dfsg-1) forky: resolved (fixed in 4.7.2+dfsg-1)

CVE-2018-10100 [MEDIUM] CVE-2018-10100: wordpress - Before WordPress 4.9.5, the redirection URL for the login page was not validated... Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS. Scope: local bookworm: resolved (fixed in 4.9.5+dfsg1-1) bullseye: resolved (fixed in 4.9.5+dfsg1-1) forky: resolved (fixed in 4.9.5+dfsg1-1) sid: resolved (fixed in 4.9.5+dfsg1-1) trixie: resolved (fixed in 4.9.5+dfsg1-1)

CVE-2017-6818 [MEDIUM] CVE-2017-6818: wordpress - In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripti... In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names. Scope: local bookworm: resolved (fixed in 4.7.3+dfsg-1) bullseye: resolved (fixed in 4.7.3+dfsg-1) forky: resolved (fixed in 4.7.3+dfsg-1) sid: resolved (fixed in 4.7.3+dfsg-1) trixie: resolved (fixed in 4.7.3+dfsg-1)

CVE-2016-6634 [MEDIUM] CVE-2016-6634: wordpress - Cross-site scripting (XSS) vulnerability in the network settings page in WordPre... Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Scope: local bookworm: resolved (fixed in 4.5+dfsg-1) bullseye: resolved (fixed in 4.5+dfsg-1) forky: resolved (fixed in 4.5+dfsg-1) sid: resolved (fixed in 4.5+dfsg-1) trixie: resolve

CVE-2017-5490 [MEDIUM] CVE-2017-5490: wordpress - Cross-site scripting (XSS) vulnerability in the theme-name fallback functionalit... Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php. Scope: local bookworm: resolved (fixed in 4.7.1+dfsg-1) bul

CVE-2017-14721 [MEDIUM] CVE-2017-14721: wordpress - Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin edito... Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name. Scope: local bookworm: resolved (fixed in 4.8.2+dfsg-1) bullseye: resolved (fixed in 4.8.2+dfsg-1) forky: resolved (fixed in 4.8.2+dfsg-1) sid: resolved (fixed in 4.8.2+dfsg-1) trixie: resolved (fixed in 4.8.2+dfsg-1)

CVE-2017-14720 [MEDIUM] CVE-2017-14720: wordpress - Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the tem... Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. Scope: local bookworm: resolved (fixed in 4.8.2+dfsg-1) bullseye: resolved (fixed in 4.8.2+dfsg-1) forky: resolved (fixed in 4.8.2+dfsg-1) sid: resolved (fixed in 4.8.2+dfsg-1) trixie: resolved (fixed in 4.8.2+dfsg-1)

CVE-2018-5776 [MEDIUM] CVE-2018-5776: wordpress - WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (unde... WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement). Scope: local bookworm: resolved (fixed in 4.9.2+dfsg-1) bullseye: resolved (fixed in 4.9.2+dfsg-1) forky: resolved (fixed in 4.9.2+dfsg-1) sid: resolved (fixed in 4.9.2+dfsg-1) trixie: resolved (fixed in 4.9.2+dfsg-1)

CVE-2017-9061 [MEDIUM] CVE-2017-9061: wordpress - In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists whe... In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename. Scope: local bookworm: resolved (fixed in 4.7.5+dfsg-1) bullseye: resolved (fixed in 4.7.5+dfsg-1) forky: resolved (fixed in 4.7.5+dfsg-1) sid: resolved (fixed in

CVE-2019-16221 [MEDIUM] CVE-2019-16221: wordpress - WordPress before 5.2.3 allows reflected XSS in the dashboard. WordPress before 5.2.3 allows reflected XSS in the dashboard. Scope: local bookworm: resolved (fixed in 5.2.3+dfsg1-1) bullseye: resolved (fixed in 5.2.3+dfsg1-1) forky: resolved (fixed in 5.2.3+dfsg1-1) sid: resolved (fixed in 5.2.3+dfsg1-1) trixie: resolved (fixed in 5.2.3+dfsg1-1)