sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total179
Critical16
High55
Medium106
Reset
Showing 161-179 of 179 records
Threat Entry Updated 2026-06-17

WordPress Core - Open Redirect (CVE-2016-2221)

Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.

CORE WordPress Core

CVE-2016-2221

HIGH CVSS 7.4 2016-05-22
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2016-1564)

Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php.

CORE WordPress Core

CVE-2016-1564

MEDIUM CVSS 6.1 2016-05-22
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2015-8834)

Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440.

CORE WordPress Core

CVE-2015-8834

MEDIUM CVSS 6.1 2016-05-22
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Security Vulnerability (CVE-2015-5715)

The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.

CORE WordPress Core

CVE-2015-5715

MEDIUM CVSS 4.3 2016-05-22
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Request Forgery (CSRF) (CVE-2015-5731)

Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests that lock a post, and consequently cause a denial of service (editing blockage), via a get-post-lock action.

CORE WordPress Core

CVE-2015-5731

MEDIUM CVSS 6.8 2015-11-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Security Vulnerability (CVE-2015-5730)

The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.

CORE WordPress Core

CVE-2015-5730

MEDIUM CVSS 5.0 2015-11-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - SQL Injection (CVE-2015-2213)

SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash.

CORE WordPress Core

CVE-2015-2213

HIGH CVSS 7.5 2015-11-09
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2015-3439)

Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.

CORE WordPress Core

CVE-2015-3439

MEDIUM CVSS 4.3 2015-08-05
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2015-3438)

Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment.

CORE WordPress Core

CVE-2015-3438

MEDIUM CVSS 4.3 2015-08-05
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Security Vulnerability (CVE-2015-5623)

WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.

CORE WordPress Core

CVE-2015-5623

MEDIUM CVSS 4.0 2015-08-03
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2015-5622)

Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.

CORE WordPress Core

CVE-2015-5622

LOW CVSS 3.5 2015-08-03
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2015-3440)

Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.

CORE WordPress Core

CVE-2015-3440

MEDIUM CVSS 4.3 2015-08-03
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.