Iniciar sesión
Deutsch English Español Polski
Media

WordPress <= 6.9.1 - Missing Authorization to Authenticated (Author+) Sensitive Information Disclosure via query-attachments AJAX Endpoint

  • Publicada: 10.03.2026
  • Actualizado: 11.10.2026 10:22

WordPress core is vulnerable to Missing Authorization in all versions up to and including 6.9.1. This is due to a missing capability check on the uploadedToTitle and uploadedToLink fields in the wp_prepare_attachment_for_js() function. When querying media attachments via the AJAX query-attachments endpoint, the response includes the parent post's title without verifying whether the current user has read_post permission on the parent post. This makes it possible for authenticated attackers with Author-level access to discover the titles of private, draft, and restricted posts that have media attachments.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
WordPress (núcleo) WordPress >= 6.8, <= 6.8.3, >= 6.9, <= 6.9.1 6.8.4, 6.9.2

Referencias

Puntuación CVSS 4.3/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Debilidad (CWE)
CWE-862
Plataforma
WordPress
Paquete
WordPress
Publicada
10.03.2026
Actualizado
11.10.2026 10:22

Fuentes y licencias

Wordfence Intelligence - 3e0b4faf-35cd-4f59-ae77-fb4f4819ad32 - Wordfence Intelligence

Copyright 2012-2026 Defiant Inc.

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Wordfence Intelligence
Wordfence Intelligence - Defiant, Inc.
Copyright Defiant, Inc. All rights reserved except as granted below.
License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026):

Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy.

Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/

Historial de vulnerabilidades: WordPress

Todas las vulnerabilidades publicadas de este paquete (WordPress (núcleo)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (385) en el archivo
Entradas en total
385
Primera → última
06.2003 10.2026
Sin corrección
0
Explotada en ataques
3

Distribución por gravedad

  • Crítica 16
  • Alta 95
  • Media 263
  • Baja 11

Divulgaciones por año

antes: 205

Gravedad:
  1. WordPress Core 7.1 - 7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments
    Alta · 7.2 4a3e3e6e-9c17-4ac5-9f83-1e01365436e9 >= 7.1.0, <= 7.1.2 7.1.3
  2. WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal
    Alta · 8.1 Explotada en ataques CVE-2026-87902 >= 4.7, <= 4.7.36, >= 4.8, <= 4.8.31, >= 4.9, <= 4.9.32, >= 5.0, <= 5.0.28, >= 5.1, <= 5.1.25, >= 5.2, <= 5.2.27, >= 5.3, <= 5.3.24, >= 5.4, <= 5.4.22, >= 5.5, <= 5.5.21, >= 5.6, <= 5.6.20, >= 5.7, <= 5.7.18, >= 5.8, <= 5.8.16, >= 5.9, <= 5.9.17, >= 6.0, <= 6.0.15, >= 6.1, <= 6.1.13, >= 6.2, <= 6.2.12, >= 6.3, <= 6.3.11, >= 6.4, <= 6.4.11, >= 6.5, <= 6.5.11, >= 6.6, <= 6.6.8, >= 6.7, <= 6.7.8, >= 6.8, <= 6.8.9, >= 6.9, <= 6.9.8, >= 7.0, <= 7.0.5, >= 7.1, <= 7.1.1 4.7.37, 4.8.32, 4.9.33, 5.0.29, 5.1.26, 5.2.28, 5.3.25, 5.4.23, 5.5.22, 5.6.21, 5.7.19, 5.8.17, 5.9.18, 6.0.16, 6.1.14, 6.2.13, 6.3.12, 6.4.12, 6.5.12, 6.6.9, 6.7.9, 6.8.10, 6.9.9, 7.0.6, 7.1.2
  3. WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling
    Alta · 7.2 CVE-2026-93485 <= 6.6.7, >= 6.7, <= 6.7.7, >= 6.8, <= 6.8.8, >= 6.9, <= 6.9.7, >= 7.0, <= 7.0.4, = 7.1 6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1
  4. WordPress Core <= 7.0.3 - Authenticated (Author+) Remote Code Execution via Malicious File Upload
    Alta · 8.8 CVE-2026-65640 >= 4.7.0, <= 4.7.34, >= 4.8.0, <= 4.8.29, >= 4.9.0, <= 4.9.30, >= 5.0.0, <= 5.0.26, >= 5.1.0, <= 5.1.23, >= 5.2.0, <= 5.2.25, >= 5.3.0, <= 5.3.22, >= 5.4.0, <= 5.4.20, >= 5.5.0, <= 5.5.19, >= 5.6.0, <= 5.6.18, >= 5.7.0, <= 5.7.16, >= 5.8.0, <= 5.8.14, >= 5.9.0, <= 5.9.15, >= 6.0.0, <= 6.0.13, >= 6.1.0, <= 6.1.11, >= 6.2.0, <= 6.2.10, >= 6.3.0, <= 6.3.9, >= 6.4.0, <= 6.4.9, >= 6.5.0, <= 6.5.9, >= 6.6.0, <= 6.6.6, >= 6.7.0, <= 6.7.6, >= 6.8.0, <= 6.8.7, >= 6.9.0, <= 6.9.6, >= 7.0.0, <= 7.0.3 4.7.35, 4.8.30, 4.9.31, 5.0.27, 5.1.24, 5.2.26, 5.3.23, 5.4.21, 5.5.20, 5.6.19, 5.7.17, 5.8.15, 5.9.16, 6.0.14, 6.1.12, 6.2.11, 6.3.10, 6.4.10, 6.5.10, 6.6.7, 6.7.7, 6.8.8, 6.9.7, 7.0.4
  5. WordPress Core 6.8 - 7.0.1 - Unauthenticated SQL Injection via author__not_in Parameter
    Alta · 7.5 Explotada en ataques CVE-2026-60137 >= 6.8, < 6.8.5, >= 6.9, < 6.9.5, >= 7.0, < 7.0.2 6.8.6, 6.9.5, 7.0.2
  6. WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion
    Crítica · 9.8 Explotada en ataques CVE-2026-63030 >= 6.9, < 6.9.5, >= 7.0, < 7.0.2 6.9.5, 7.0.2
  7. WordPress <= 6.9.1 - Missing Authorization to Authenticated (Author+) Sensitive Information Disclosure via query-attachments AJAX Endpoint esta entrada
    Media · 4.3 3e0b4faf-35cd-4f59-ae77-fb4f4819ad32 >= 6.8, <= 6.8.3, >= 6.9, <= 6.9.1 6.8.4, 6.9.2
  8. WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block
    Alta · 7.2 CVE-2024-4439 >= 6.0, <= 6.0.7, >= 6.1, <= 6.1.5, >= 6.2, <= 6.2.4, >= 6.3, <= 6.3.3, >= 6.4, <= 6.4.3, >= 6.5, <= 6.5.1 6.0.8, 6.1.6, 6.2.5, 6.3.4, 6.4.4, 6.5.2
  9. WordPress Core 6.4.0 - 6.4.1 - Remote Code Execution POP Chain
    Crítica · 9.8 CVE-2024-31211 = 6.4.0, = 6.4.1 6.4.2
  10. WordPress Core < 6.0.3 - SQL Injection via WP_Date_Query
    Crítica · 9.8 ff4b47d8-28c1-4706-91d9-0285f419147e <= 3.6.1, >= 3.7, <= 3.7.39, >= 3.8, <= 3.8.39, >= 3.9, <= 3.9.37, >= 4.0, <= 4.0.36, >= 4.1, <= 4.1.36, >= 4.2, <= 4.2.33, >= 4.3, <= 4.3.29, >= 4.4, <= 4.4.28, >= 4.5, <= 4.5.27, >= 4.6, <= 4.6.24, >= 4.7, <= 4.7.24, >= 4.8, <= 4.8.20, >= 4.9, <= 4.9.21, >= 5.0, <= 5.0.17, >= 5.1, <= 5.1.14, >= 5.2, <= 5.2.16, >= 5.3, <= 5.3.13, >= 5.4, <= 5.4.11, >= 5.5, <= 5.5.10, >= 5.6, <= 5.6.9, >= 5.7, <= 5.7.7, >= 5.8, <= 5.8.5, >= 5.9, <= 5.9.4, >= 6.0, <= 6.0.2 3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3
  11. WordPress Core < 6.0.3 - Cross-Site Request Forgery via wp-trackback.php
    Alta · 8.8 ddd06190-d0c1-445d-8c6f-4c7df3248db4 <= 3.6.1, >= 3.7, <= 3.7.39, >= 3.8, <= 3.8.39, >= 3.9, <= 3.9.37, >= 4.0, <= 4.0.36, >= 4.1, <= 4.1.36, >= 4.2, <= 4.2.33, >= 4.3, <= 4.3.29, >= 4.4, <= 4.4.28, >= 4.5, <= 4.5.27, >= 4.6, <= 4.6.24, >= 4.7, <= 4.7.24, >= 4.8, <= 4.8.20, >= 4.9, <= 4.9.21, >= 5.0, <= 5.0.17, >= 5.1, <= 5.1.14, >= 5.2, <= 5.2.16, >= 5.3, <= 5.3.13, >= 5.4, <= 5.4.11, >= 5.5, <= 5.5.10, >= 5.6, <= 5.6.9, >= 5.7, <= 5.7.7, >= 5.8, <= 5.8.5, >= 5.9, <= 5.9.4, >= 6.0, <= 6.0.2 3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3
  12. WordPress Core < 6.0.3 - Reflected Cross-Site Scripting via SQL Injection
    Alta · 8.8 CVE-2022-43497 <= 3.6.1, >= 3.7, <= 3.7.39, >= 3.8, <= 3.8.39, >= 3.9, <= 3.9.37, >= 4.0, <= 4.0.36, >= 4.1, <= 4.1.36, >= 4.2, <= 4.2.33, >= 4.3, <= 4.3.29, >= 4.4, <= 4.4.28, >= 4.5, <= 4.5.27, >= 4.6, <= 4.6.24, >= 4.7, <= 4.7.24, >= 4.8, <= 4.8.20, >= 4.9, <= 4.9.21, >= 5.0, <= 5.0.17, >= 5.1, <= 5.1.14, >= 5.2, <= 5.2.16, >= 5.3, <= 5.3.13, >= 5.4, <= 5.4.11, >= 5.5, <= 5.5.10, >= 5.6, <= 5.6.9, >= 5.7, <= 5.7.7, >= 5.8, <= 5.8.5, >= 5.9, <= 5.9.4, >= 6.0, <= 6.0.2 3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3
  13. WordPress Core < 6.0.2 - Authenticated SQL Injection
    Alta · 8.0 0248f829-84de-40b9-bb63-354fbf06472d <= 3.6.1, >= 3.7, <= 3.7.38, >= 3.8, <= 3.8.38, >= 3.9, <= 3.9.36, >= 4.0, <= 4.0.35, >= 4.1, <= 4.1.35, >= 4.2, <= 4.2.32, >= 4.3, <= 4.3.28, >= 4.4, <= 4.4.27, >= 4.5, <= 4.5.26, >= 4.6, <= 4.6.23, >= 4.7, <= 4.7.23, >= 4.8, <= 4.8.19, >= 4.9, <= 4.9.20, >= 5.0, <= 5.0.16, >= 5.1, <= 5.1.13, >= 5.2, <= 5.2.15, >= 5.3, <= 5.3.12, >= 5.4, <= 5.4.10, >= 5.5, <= 5.5.9, >= 5.6, <= 5.6.8, >= 5.7, <= 5.7.6, >= 5.8, <= 5.8.4, >= 5.9, <= 5.9.3, >= 6.0, <= 6.0.1 3.7.39, 3.8.39, 3.9.37, 4.0.36, 4.1.36, 4.2.33, 4.3.29, 4.4.28, 4.5.27, 4.6.24, 4.7.24, 4.8.20, 4.9.21, 5.0.17, 5.1.14, 5.2.16, 5.3.13, 5.4.11, 5.5.10, 5.6.9, 5.7.7, 5.8.5, 5.9.4, 6.0.2
  14. WordPress Core < 5.9.1 - jQuery Prototype Pollution
    Alta · 8.8 CVE-2021-20083 < 3.7, >= 3.7, <= 3.7.37, >= 3.8, <= 3.8.37, >= 3.9, <= 3.9.35, >= 4.0, <= 4.0.34, >= 4.1, <= 4.1.34, >= 4.2, <= 4.2.31, >= 4.3, <= 4.3.27, >= 4.4, <= 4.4.26, >= 4.5, <= 4.5.25, >= 4.6, <= 4.6.22, >= 4.7, <= 4.7.22, >= 4.8, <= 4.8.18, >= 4.9, <= 4.9.19, >= 5.0, <= 5.0.15, >= 5.1, <= 5.1.12, >= 5.2, <= 5.2.14, >= 5.3, <= 5.3.11, >= 5.4, <= 5.4.9, >= 5.5, <= 5.5.8, >= 5.6, <= 5.6.7, >= 5.7, <= 5.7.5, >= 5.8, <= 5.8.3, >= 5.9, <= 5.9.1 3.7.38, 3.8.38, 3.9.36, 4.0.35, 4.1.35, 4.2.32, 4.3.28, 4.4.27, 4.5.26, 4.6.23, 4.7.23, 4.8.19, 4.9.20, 5.0.16, 5.1.13, 5.2.15, 5.3.12, 5.4.10, 5.5.9, 5.6.8, 5.7.6, 5.8.4, 5.9.2
  15. WordPress Core < 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting
    Alta · 8.0 CVE-2022-21662 >= 3.7, < 3.7.37, >= 3.8, < 3.8.37, >= 3.9, < 3.9.35, >= 4.0, < 4.0.34, >= 4.1, < 4.1.34, >= 4.2, < 4.2.31, >= 4.3, < 4.3.27, >= 4.4, < 4.4.26, >= 4.5, < 4.5.25, >= 4.6, < 4.6.22, >= 4.7, < 4.7.22, >= 4.8, < 4.8.18, >= 4.9, < 4.9.19, >= 5.0, < 5.0.15, >= 5.1, < 5.1.12, >= 5.2, < 5.2.14, >= 5.3, < 5.3.11, >= 5.4, < 5.4.9, >= 5.5, < 5.5.8, >= 5.6, < 5.6.7, >= 5.7, < 5.7.5, >= 5.8, < 5.8.3 3.7.37, 3.8.37, 3.9.35, 4.0.34, 4.1.34, 4.2.31, 4.3.27, 4.4.26, 4.5.25, 4.6.22, 4.7.22, 4.8.18, 4.9.19, 5.0.15, 5.1.12, 5.2.14, 5.3.11, 5.4.9, 5.5.8, 5.6.7, 5.7.5, 5.8.3
  16. WordPress Core < 5.8.3 - SQL Injection via WP_Meta_Query
    Alta · 7.4 CVE-2022-21664 >= 4.1, < 4.1.34, >= 4.2, < 4.2.31, >= 4.3, < 4.3.27, >= 4.4, < 4.4.26, >= 4.5, < 4.5.25, >= 4.6, < 4.6.22, >= 4.7, < 4.7.22, >= 4.8, < 4.8.18, >= 4.9, < 4.9.19, >= 5.0, < 5.0.15, >= 5.1, < 5.1.12, >= 5.2, < 5.2.14, >= 5.3, < 5.3.11, >= 5.4, < 5.4.9, >= 5.5, < 5.5.8, >= 5.6, < 5.6.7, >= 5.7, < 5.7.5, >= 5.8, < 5.8.3 4.1.34, 4.2.31, 4.3.27, 4.4.26, 4.5.25, 4.6.22, 4.7.22, 4.8.18, 4.9.19, 5.0.15, 5.1.12, 5.2.14, 5.3.11, 5.4.9, 5.5.8, 5.6.7, 5.7.5, 5.8.3
  17. WordPress Core 5.4 - 5.8 - Authenticated Stored Cross-Site Scripting
    Alta · 7.6 CVE-2021-39201 >= 5.4, < 5.4.7, >= 5.5, < 5.5.6, >= 5.6, < 5.6.5, >= 5.7, < 5.7.3, >= 5.8, < 5.8.1 5.4.7, 5.5.6, 5.6.5, 5.7.3, 5.8.1
  18. WordPress Core < 5.7.1 - XXE Injection
    Alta · 7.1 CVE-2021-29447 >= 4.7, < 4.7.20, >= 4.8, < 4.8.16, >= 4.9, < 4.9.17, >= 5.0, < 5.0.12, >= 5.1, < 5.1.9, >= 5.2, < 5.2.10, >= 5.3, < 5.3.7, >= 5.4, < 5.4.5, >= 5.5, < 5.5.4, >= 5.6, < 5.6.3, >= 5.7, < 5.7.1 4.7.20, 4.8.16, 4.9.17, 5.0.12, 5.1.9, 5.2.10, 5.3.7, 5.4.5, 5.5.4, 5.6.3, 5.7.1
  19. WordPress Core < 5.8.3 - SQL Injection via WP_Query
    Alta · 8.0 CVE-2022-21661 >= 3.7, < 3.7.37, >= 3.8, < 3.8.37, >= 3.9, < 3.9.35, >= 4.0, < 4.0.34, >= 4.1, < 4.1.34, >= 4.2, < 4.2.31, >= 4.3, < 4.3.27, >= 4.4, < 4.4.26, >= 4.5, < 4.5.25, >= 4.6, < 4.6.22, >= 4.7, < 4.7.22, >= 4.8, < 4.8.18, >= 4.9, < 4.9.19, >= 5.0, < 5.0.15, >= 5.1, < 5.1.12, >= 5.2, < 5.2.14, >= 5.3, < 5.3.11, >= 5.4, < 5.4.9, >= 5.5, < 5.5.8, >= 5.6, < 5.6.7, >= 5.7, < 5.7.5, >= 5.8, < 5.8.3 3.7.37, 3.8.37, 3.9.35, 4.0.34, 4.1.34, 4.2.31, 4.3.27, 4.4.26, 4.5.25, 4.6.22, 4.7.22, 4.8.18, 4.9.19, 5.0.15, 5.1.12, 5.2.14, 5.3.11, 5.4.9, 5.5.8, 5.6.7, 5.7.5, 5.8.3
  20. WordPress Core < 5.5.2 - Privilege Escalation via XML-RPC
    Alta · 8.8 CVE-2020-28035 < 3.7, >= 3.7, <= 3.7.34, >= 3.8, <= 3.8.34, >= 3.9, <= 3.9.32, >= 4.0, <= 4.0.31, >= 4.1, <= 4.1.31, >= 4.2, <= 4.2.28, >= 4.3, <= 4.3.24, >= 4.4, <= 4.4.23, >= 4.5, <= 4.5.22, >= 4.6, <= 4.6.19, >= 4.7, <= 4.7.18, >= 4.8, <= 4.8.14, >= 4.9, <= 4.9.15, >= 5.0, <= 5.0.10, >= 5.1, <= 5.1.6, >= 5.2, <= 5.2.7, >= 5.3, <= 5.3.4, >= 5.4, <= 5.4.2, >= 5.5, <= 5.5.1 3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2
  21. WordPress Core < 5.5.2 - Deserialization Gadget
    Alta · 8.8 CVE-2020-28032 < 3.7, >= 3.7, <= 3.7.34, >= 3.8, <= 3.8.34, >= 3.9, <= 3.9.32, >= 4.0, <= 4.0.31, >= 4.1, <= 4.1.31, >= 4.2, <= 4.2.28, >= 4.3, <= 4.3.24, >= 4.4, <= 4.4.23, >= 4.5, <= 4.5.22, >= 4.6, <= 4.6.19, >= 4.7, <= 4.7.18, >= 4.8, <= 4.8.14, >= 4.9, <= 4.9.15, >= 5.0, <= 5.0.10, >= 5.1, <= 5.1.6, >= 5.2, <= 5.2.7, >= 5.3, <= 5.3.4, >= 5.4, <= 5.4.2, >= 5.5, <= 5.5.1 3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2
  22. WordPress Core < 5.5.2 - Privilege Escalation via XML-RPC
    Alta · 8.8 CVE-2020-28036 < 3.7, >= 3.7, <= 3.7.34, >= 3.8, <= 3.8.34, >= 3.9, <= 3.9.32, >= 4.0, <= 4.0.31, >= 4.1, <= 4.1.31, >= 4.2, <= 4.2.28, >= 4.3, <= 4.3.24, >= 4.4, <= 4.4.23, >= 4.5, <= 4.5.22, >= 4.6, <= 4.6.19, >= 4.7, <= 4.7.18, >= 4.8, <= 4.8.14, >= 4.9, <= 4.9.15, >= 5.0, <= 5.0.10, >= 5.1, <= 5.1.6, >= 5.2, <= 5.2.7, >= 5.3, <= 5.3.4, >= 5.4, <= 5.4.2, >= 5.5, <= 5.5.1 3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2
  23. WordPress Core < 5.5.3 - PHP Object Injection Gadget
    Crítica · 9.8 CVE-2021-29476 < 3.7, >= 3.7, < 3.7.35, >= 3.8, < 3.8.35, >= 3.9, < 3.9.33, >= 4.0, < 4.0.32, >= 4.1, < 4.1.32, >= 4.2, < 4.2.29, >= 4.3, < 4.3.25, >= 4.4, < 4.4.24, >= 4.5, < 4.5.23, >= 4.6, < 4.6.20, >= 4.7, < 4.7.19, >= 4.8, < 4.8.15, >= 4.9, < 4.9.16, >= 5.0, < 5.0.11, >= 5.1, < 5.1.8, >= 5.2, < 5.2.9, >= 5.3, < 5.3.6, >= 5.4, < 5.4.4, >= 5.5, < 5.5.3 3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.8, 5.2.9, 5.3.6, 5.4.4, 5.5.3
  24. WordPress Core < 5.2.4 - Cache Poisoning
    Alta · 7.3 CVE-2019-17673 < 3.7, >= 3.7, <= 3.7.30, >= 3.8, <= 3.8.30, >= 3.9, <= 3.9.28, >= 4.0, <= 4.0.27, >= 4.1, <= 4.1.27, >= 4.2, <= 4.2.24, >= 4.3, <= 4.3.20, >= 4.4, <= 4.4.19, >= 4.5, <= 4.5.18, >= 4.6, <= 4.6.15, >= 4.7, <= 4.7.14, >= 4.8, <= 4.8.10, >= 4.9, <= 4.9.11, >= 5.0, <= 5.0.6, >= 5.1, <= 5.1.2, >= 5.2, <= 5.2.3 3.7.31, 3.8.31, 3.9.29, 4.0.28, 4.1.28, 4.2.25, 4.3.21, 4.4.20, 4.5.19, 4.6.16, 4.7.15, 4.8.11, 4.9.12, 5.0.7, 5.1.3, 5.2.4
  25. WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments
    Alta · 7.2 CVE-2019-16218 < 3.7, >= 3.7, <= 3.7.29, >= 3.8, <= 3.8.29, >= 3.9, <= 3.9.27, >= 4.0, <= 4.0.26, >= 4.1, <= 4.1.26, >= 4.2, <= 4.2.23, >= 4.3, <= 4.3.19, >= 4.4, <= 4.4.18, >= 4.5, <= 4.5.17, >= 4.6, <= 4.6.13, >= 4.7, <= 4.7.12, >= 4.8, <= 4.8.9, >= 4.9, <= 4.9.10, >= 5.0, <= 5.0.5, >= 5.1, <= 5.1.1, >= 5.2, <= 5.2.2 3.7.30, 3.8.30, 3.9.28, 4.0.27, 4.1.27, 4.2.24, 4.3.20, 4.4.19, 4.5.18, 4.6.15, 4.7.13, 4.8.10, 4.9.11, 5.0.6, 5.1.2, 5.2.3
  26. WordPress Core < 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments
    Crítica · 9.6 CVE-2019-9787 < 3.7, >= 3.7, <= 3.7.28, >= 3.8, <= 3.8.28, >= 3.9, <= 3.9.26, >= 4.0, <= 4.0.25, >= 4.1, <= 4.1.25, >= 4.2, <= 4.2.22, >= 4.3, <= 4.3.18, >= 4.4, <= 4.4.17, >= 4.5, <= 4.5.16, >= 4.6, <= 4.6.13, >= 4.7, <= 4.7.12, >= 4.8, <= 4.8.8, >= 4.9, <= 4.9.9, >= 5.0, <= 5.0.3, = 5.1 3.7.29, 3.8.29, 3.9.27, 4.0.26, 4.1.26, 4.2.23, 4.3.19, 4.4.18, 4.5.17, 4.6.14, 4.7.13, 4.8.9, 4.9.10, 5.0.4, 5.1.1
  27. WordPress Core < 5.0.1 - Remote Code Execution
    Alta · 8.8 CVE-2019-8942 < 3.7, >= 3.7, <= 3.7.27, >= 3.8, <= 3.8.27, >= 3.9, <= 3.9.25, >= 4.0, <= 4.0.24, >= 4.1, <= 4.1.24, >= 4.2, <= 4.2.21, >= 4.3, <= 4.3.17, >= 4.4, <= 4.4.16, >= 4.5, <= 4.5.15, >= 4.6, <= 4.6.12, >= 4.7, <= 4.7.11, >= 4.8, <= 4.8.7, >= 4.9, <= 4.9.8, = 5.0 3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1
  28. WordPress Core < 5.0.1 - Sensitive Information Disclosure
    Alta · 7.5 CVE-2018-20151 < 3.7, >= 3.7, <= 3.7.27, >= 3.8, <= 3.8.27, >= 3.9, <= 3.9.25, >= 4.0, <= 4.0.24, >= 4.1, <= 4.1.24, >= 4.2, <= 4.2.21, >= 4.3, <= 4.3.17, >= 4.4, <= 4.4.16, >= 4.5, <= 4.5.15, >= 4.6, <= 4.6.12, >= 4.7, <= 4.7.11, >= 4.8, <= 4.8.7, >= 4.9, <= 4.9.8, = 5.0 3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1
  29. WordPress Core < 5.0.1 - Arbitrary File Deletion
    Alta · 7.7 CVE-2018-20147 < 3.7, >= 3.7, <= 3.7.27, >= 3.8, <= 3.8.27, >= 3.9, <= 3.9.25, >= 4.0, <= 4.0.24, >= 4.1, <= 4.1.24, >= 4.2, <= 4.2.21, >= 4.3, <= 4.3.17, >= 4.4, <= 4.4.16, >= 4.5, <= 4.5.15, >= 4.6, <= 4.6.12, >= 4.7, <= 4.7.11, >= 4.8, <= 4.8.7, >= 4.9, <= 4.9.8, = 5.0 3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1
  30. WordPress Core < 5.0.1 - PHP Object Injection
    Alta · 8.8 CVE-2018-20148 < 3.7, >= 3.7, <= 3.7.27, >= 3.8, <= 3.8.27, >= 3.9, <= 3.9.25, >= 4.0, <= 4.0.24, >= 4.1, <= 4.1.24, >= 4.2, <= 4.2.21, >= 4.3, <= 4.3.17, >= 4.4, <= 4.4.16, >= 4.5, <= 4.5.15, >= 4.6, <= 4.6.12, >= 4.7, <= 4.7.11, >= 4.8, <= 4.8.7, >= 4.9, <= 4.9.8, = 5.0 3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1
  31. WordPress Core < 5.0.1 - PHAR Unserialization
    Alta · 7.5 CVE-2018-1000773 < 3.7, >= 3.7, <= 3.7.27, >= 3.8, <= 3.8.27, >= 3.9, <= 3.9.25, >= 4.0, <= 4.0.24, >= 4.1, <= 4.1.24, >= 4.2, <= 4.2.21, >= 4.3, <= 4.3.17, >= 4.4, <= 4.4.16, >= 4.5, <= 4.5.15, >= 4.6, <= 4.6.12, >= 4.7, <= 4.7.11, >= 4.8, <= 4.8.7, >= 4.9, <= 4.9.8, = 5.0 3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1
  32. WordPress Core < 4.9 - Insecure Deserialization
    Alta · 8.8 CVE-2017-1000600 < 4.9 4.9
  33. WordPress Core < 4.9.7 - Authenticated Arbitrary File Deletion
    Alta · 8.8 CVE-2018-12895 < 3.7, >= 3.7, <= 3.7.26, >= 3.8, <= 3.8.26, >= 3.9, <= 3.9.24, >= 4.0, <= 4.0.23, >= 4.1, <= 4.1.23, >= 4.2, <= 4.2.20, >= 4.3, <= 4.3.16, >= 4.4, <= 4.4.15, >= 4.5, <= 4.5.14, >= 4.6, <= 4.6.11, >= 4.7, <= 4.7.10, >= 4.8, <= 4.8.6, >= 4.9, <= 4.9.6 3.7.27, 3.8.27, 3.9.25, 4.0.24, 4.1.24, 4.2.21, 4.3.17, 4.4.16, 4.5.15, 4.6.12, 4.7.11, 4.8.7, 4.9.7
  34. WordPress Core < 5.0 - Denial of Service
    Alta · 7.5 CVE-2018-6389 < 5.0 5.0
  35. WordPress Core < 4.8.3 - SQL Injection due to Double Prepare approach
    Crítica · 9.8 CVE-2017-16510 < 3.7, >= 3.7, <= 3.7.22, >= 3.8, <= 3.8.22, >= 3.9, <= 3.9.20, >= 4.0, <= 4.0.19, >= 4.1, <= 4.1.19, >= 4.2, <= 4.2.16, >= 4.3, <= 4.3.12, >= 4.4, <= 4.4.11, >= 4.5, <= 4.5.10, >= 4.6, <= 4.6.7, >= 4.7, <= 4.7.6, >= 4.8, <= 4.8.2 3.7.23, 3.8.23, 3.9.21, 4.0.20, 4.1.20, 4.2.17, 4.3.13, 4.4.12, 4.5.11, 4.6.8, 4.7.7, 4.8.3
  36. WordPress Core < 4.8.2 - SQL Injection via Mishandled Placeholders
    Crítica · 9.8 CVE-2017-14723 < 3.7, >= 3.7, <= 3.7.21, >= 3.8, <= 3.8.21, >= 3.9, <= 3.9.19, >= 4.0, <= 4.0.18, >= 4.1, <= 4.1.18, >= 4.2, <= 4.2.15, >= 4.3, <= 4.3.11, >= 4.4, <= 4.4.10, >= 4.5, <= 4.5.9, >= 4.6, <= 4.6.6, >= 4.7, <= 4.7.5, >= 4.8, <= 4.8.1 3.7.22, 3.8.22, 3.9.20, 4.0.19, 4.1.19, 4.2.16, 4.3.12, 4.4.11, 4.5.10, 4.6.7, 4.7.6, 4.8.2
  37. WordPress Core < 4.7.5 - Server-Side Request Forgery
    Alta · 7.7 CVE-2017-9066 < 3.7, >= 3.7, <= 3.7.20, >= 3.8, <= 3.8.20, >= 3.9, <= 3.9.18, >= 4.0, <= 4.0.17, >= 4.1, <= 4.1.17, >= 4.2, <= 4.2.14, >= 4.3, <= 4.3.10, >= 4.4, <= 4.4.9, >= 4.5, <= 4.5.8, >= 4.6, <= 4.6.5, >= 4.7, <= 4.7.4 3.7.21, 3.8.21, 3.9.19, 4.0.18, 4.1.18, 4.2.15, 4.3.11, 4.4.10, 4.5.9, 4.6.6, 4.7.5
  38. WordPress Core < 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update
    Alta · 8.8 CVE-2017-9064 < 3.7, >= 3.7, <= 3.7.20, >= 3.8, <= 3.8.20, >= 3.9, <= 3.9.18, >= 4.0, <= 4.0.17, >= 4.1, <= 4.1.17, >= 4.2, <= 4.2.14, >= 4.3, <= 4.3.10, >= 4.4, <= 4.4.9, >= 4.5, <= 4.5.8, >= 4.6, <= 4.6.5, >= 4.7, <= 4.7.4 3.7.21, 3.8.21, 3.9.19, 4.0.18, 4.1.18, 4.2.15, 4.3.11, 4.4.10, 4.5.9, 4.6.6, 4.7.5
  39. WordPress Core < 4.7.3 - Cross-Site Request Forgery via Press This
    Alta · 8.8 CVE-2017-6819 < 3.7, >= 3.7, <= 3.7.18, >= 3.8, <= 3.8.18, >= 3.9, <= 3.9.16, >= 4.0, <= 4.0.15, >= 4.1, <= 4.1.15, >= 4.2, <= 4.2.12, >= 4.3, <= 4.3.8, >= 4.4, <= 4.4.7, >= 4.5, <= 4.5.6, >= 4.6, <= 4.6.3, >= 4.7, <= 4.7.2 3.7.19, 3.8.19, 3.9.17, 4.0.16, 4.1.16, 4.2.13, 4.3.9, 4.4.8, 4.5.7, 4.6.4, 4.7.3
  40. WordPress Core < 4.7.2 - Authenticated SQL Injection
    Alta · 8.8 CVE-2017-5611 < 3.7, >= 3.7, <= 3.7.17, >= 3.8, <= 3.8.17, >= 3.9, <= 3.9.15, >= 4.0, <= 4.0.14, >= 4.1, <= 4.1.14, >= 4.2, <= 4.2.11, >= 4.3, <= 4.3.7, >= 4.4, <= 4.4.6, >= 4.5, <= 4.5.5, >= 4.6, <= 4.6.2, >= 4.7, <= 4.7.1 3.7.18, 3.8.18, 3.9.16, 4.0.15, 4.1.15, 4.2.12, 4.3.8, 4.4.7, 4.5.6, 4.6.3, 4.7.2
Mostrar más (20) Mostrando 40 de 112

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.