WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| WordPress Foundation | WordPress | 4.7.0 – ≤ 4.7.33, 4.8.0 – ≤ 4.8.28, 4.9.0 – ≤ 4.9.29, 5.0.0 – ≤ 5.0.25, 5.1.0 – ≤ 5.1.22, 5.2.0 – ≤ 5.2.24, 5.3.0 – ≤ 5.3.21, 5.4.0 – ≤ 5.4.19, 5.5.0 – ≤ 5.5.18, 5.6.0 – ≤ 5.6.17, 5.7.0 – ≤ 5.7.15, 5.8.0 – ≤ 5.8.13, 5.9.0 – ≤ 5.9.13, 6.0.0 – ≤ 6.0.12, 6.1.0 – ≤ 6.1.10, 6.2.0 – ≤ 6.2.9, 6.3.0 – ≤ 6.3.8, 6.4.0 – ≤ 6.4.8, 6.5.0 – ≤ 6.5.8, 6.6.0 – ≤ 6.6.5, 6.7.0 – ≤ 6.7.5, 6.8.0 – ≤ 6.8.6, 6.9.0 – ≤ 6.9.5, 7.0.0 – ≤ 7.0.2 |
Unser kostenloser Open-Source-Honeypot wartet auf Ports, die Ihr Server nicht nutzt, und meldet verbindende Scanner und Angreifer an eine gemeinsame Blockliste.
