Debian Wordpress vulnerabilities

CVE-2008-0195 [MEDIUM] CVE-2008-0195: wordpress - WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive informa... WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages. Scope: local bookworm: resolved (fixed in 2.1.0-1) bullseye: resolved (fixed in 2.1.0-1) forky: resolved (fixed in 2.1.0-1) sid: resolved (fixed in 2.

CVE-2015-5733 [MEDIUM] CVE-2015-5733: wordpress - Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfIt... Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title. Scope: local bookworm: resolved (fixed in 4.2.4+dfsg-1) bullseye: resolved (fixed in 4.2.4+dfsg-1) forky: resolved (fixed i

CVE-2006-3390 [MEDIUM] CVE-2006-3390: wordpress - WordPress 2.0.3 allows remote attackers to obtain the installation path via a di... WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3) wp-includes directories, possibly due to uninitialized variables. Scope: local bookworm: resolved (fixed in 2.0.4-1) bullseye: resolved (fixed in 2.0.4-1) forky: resolved (fixed in 2.0.4-1) sid: r

CVE-2016-7168 [MEDIUM] CVE-2016-7168: wordpress - Cross-site scripting (XSS) vulnerability in the media_handle_upload function in ... Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename. Scope: local bookworm: resolved (fixed in 4.6.1+dfsg-1) bullseye: resolved (f

CVE-2007-2627 [MEDIUM] CVE-2007-2627: wordpress - Cross-site scripting (XSS) vulnerability in sidebar.php in WordPress, when custo... Cross-site scripting (XSS) vulnerability in sidebar.php in WordPress, when custom 404 pages that call get_sidebar are used, allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF), a different vulnerability than CVE-2007-1622. Scope: local bookworm: resolved (fixed in 2.2.2-1) bullseye: resolved (fixed in 2.2.2-1) forky: reso

CVE-2013-2200 [MEDIUM] CVE-2013-2200: wordpress - WordPress before 3.5.2 does not properly check the capabilities of roles, which ... WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship reassignment via unspecified vectors. Scope: local bookworm: resolved (fixed in 3.5.2+dfsg-1) bullseye: resolved (fixed in 3.5.2+dfsg-1) forky: resolved (fixed in 3.5.2+dfsg-1) sid: resolved

CVE-2025-58246 [MEDIUM] CVE-2025-58246: wordpress - Insertion of Sensitive Information Into Sent Data vulnerability in WordPress all... Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges required in order to exploit it. This issue affects WordPress: from 6.8 through 6.8.2, from

CVE-2005-2109 [MEDIUM] CVE-2005-2109: wordpress - wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change ... wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the message variable, which is not initialized before use. Scope: local bookworm: resolved (fixed in 1.5.1.3-1) bullseye: resolved (fixed in 1.5.1.3-1) forky: resolved (fixed in 1.5.1.3-1) sid: resolved (fixed in 1.5.1.3-1) trixi

CVE-2015-3429 [MEDIUM] CVE-2015-3429: wordpress - Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.... Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier. Scope: local bookworm: resolved (fixed in 4.2.2+dfsg-1) bullseye: resolved (fixed in 4.2.2+dfsg-1) forky: resolved (fixed in 4.2.2+dfsg-1) sid: resolved (fi

CVE-2013-2205 [MEDIUM] CVE-2013-2205: wordpress - The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestri... The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site. Scope: local bookworm: resolved (fixed in 3.5.2+dfsg-1) bullseye: resolved (fixed in 3.5.2+dfsg-1) forky: resolved (

CVE-2014-9032 [MEDIUM] CVE-2014-9032: wordpress - Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordP... Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Scope: local bookworm: resolved (fixed in 4.0.1+dfsg-1) bullseye: resolved (fixed in 4.0.1+dfsg-1) forky: resolved (fixed in 4.0.1+dfsg-1) sid: re

CVE-2007-1599 [MEDIUM] CVE-2007-1599: wordpress - wp-login.php in WordPress allows remote attackers to redirect authenticated user... wp-login.php in WordPress allows remote attackers to redirect authenticated users to other websites and potentially obtain sensitive information via the redirect_to parameter. Scope: local bookworm: resolved (fixed in 2.2.2-1) bullseye: resolved (fixed in 2.2.2-1) forky: resolved (fixed in 2.2.2-1) sid: resolved (fixed in 2.2.2-1) trixie: resolved (fixed in 2.2.2-

CVE-2007-1622 [MEDIUM] CVE-2007-1622: wordpress - Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress befor... Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATH_INFO in the administration interface, related to loose regular expression processing of PHP_SELF. Scope: local bookworm: res

CVE-2009-2431 [MEDIUM] CVE-2009-2431: wordpress - WordPress 2.7.1 places the username of a post's author in an HTML comment, which... WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source. Scope: local bookworm: resolved (fixed in 2.8.3-1) bullseye: resolved (fixed in 2.8.3-1) forky: resolved (fixed in 2.8.3-1) sid: resolved (fixed in 2.8.3-1) trixie: resolved (fixed in 2.8.3-1)

CVE-2007-2383 [MEDIUM] CVE-2007-2383: asterisk - The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using Java... The Prototype (prototypejs) framework before 1.5.1 RC3 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijack

CVE-2010-4536 [MEDIUM] CVE-2010-4536: wordpress - Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPres... Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form. Scope: local bookworm: resolved (fixed in 3.0.

CVE-2013-0237 [MEDIUM] CVE-2013-0237: wordpress - Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload be... Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter. Scope: local bookworm: resolved (fixed in 3.5.1+dfsg-1) bullseye: resolved (fixed in 3.5.1+dfsg-1) forky: resolved (fixed in 3.5.1+dfsg

CVE-2015-5622 [LOW] CVE-2015-5622: wordpress - Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote... Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php. Scope: local bookworm: resolved (fixed in 4.2.3+dfsg-1) bullseye: r

CVE-2011-0701 [MEDIUM] CVE-2011-0701: wordpress - wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows... wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter. Scope: local bookworm: resolved (fixed in 3.0.5+dfsg-1) bullseye: resolved (fixed in 3.0.5+dfsg-1) forky: resolved (fixed in 3.0.5+dfsg-1) sid: resolved (fixed in 3.0.5+dfsg

CVE-2014-9035 [MEDIUM] CVE-2014-9035: wordpress - Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5... Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Scope: local bookworm: resolved (fixed in 4.0.1+dfsg-1) bullseye: resolved (fixed in 4.0.1+dfsg-1) forky: resolved (fixed in 4.0.1+dfsg