Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-06-17
WordPress Core - Security Vulnerability (CVE-2017-5493)
wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.
CORE
WordPress Core
CVE-2017-5493
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Arbitrary File Upload (CVE-2017-5489)
Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving a Flash file upload.
CORE
WordPress Core
CVE-2017-5489
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Cross-Site Scripting (XSS) (CVE-2017-5490)
Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php.
CORE
WordPress Core
CVE-2017-5490
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Cross-Site Scripting (XSS) (CVE-2017-5488)
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.
CORE
WordPress Core
CVE-2017-5488
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Security Vulnerability (CVE-2017-5491)
wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.
CORE
WordPress Core
CVE-2017-5491
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Information Disclosure (CVE-2017-5487)
wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.
CORE
WordPress Core
CVE-2017-5487
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Path Traversal (CVE-2016-7169)
Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter.
CORE
WordPress Core
CVE-2016-7169
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Cross-Site Scripting (XSS) (CVE-2016-7168)
Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.
CORE
WordPress Core
CVE-2016-7168
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Security Vulnerability (CVE-2016-10045)
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.
CORE
WordPress Core
CVE-2016-10045
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Security Vulnerability (CVE-2016-10033)
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
CORE
WordPress Core
CVE-2016-10033
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Cross-Site Request Forgery (CSRF) (CVE-2016-6635)
Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.
CORE
WordPress Core
CVE-2016-6635
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Cross-Site Scripting (XSS) (CVE-2016-6634)
Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CORE
WordPress Core
CVE-2016-6634
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Server-Side Request Forgery (SSRF) (CVE-2016-4029)
WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.
CORE
WordPress Core
CVE-2016-4029
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Security Vulnerability (CVE-2016-5839)
WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.
CORE
WordPress Core
CVE-2016-5839
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Security Vulnerability (CVE-2016-5838)
WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.
CORE
WordPress Core
CVE-2016-5838
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Security Vulnerability (CVE-2016-5837)
WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.
CORE
WordPress Core
CVE-2016-5837
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Denial of Service (CVE-2016-5836)
The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.
CORE
WordPress Core
CVE-2016-5836
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Security Vulnerability (CVE-2016-5835)
WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.
CORE
WordPress Core
CVE-2016-5835
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Cross-Site Scripting (XSS) (CVE-2016-5834)
Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.
CORE
WordPress Core
CVE-2016-5834
Risk Score
Threat Entry
Updated 2026-06-17
WordPress Core - Cross-Site Scripting (XSS) (CVE-2016-5833)
Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834.
CORE
WordPress Core
CVE-2016-5833
Risk Score