According to its self-reported version number, the WordPress application running on the remote web server is prior to 4.9.9, or 5.x prior to 5.0.1. It is, therefore, affected by multiple vulnerabilities, including cross-site scripting (XSS) vulnerabilities due to improper validation of user-supplied input before returning it to users.

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

 - Authors could alter meta data to delete files that they weren't authorized to.

 - Authors could create posts of unauthorized types with specially crafted input.

 - Contributors could craft meta data in a way that resulted in PHP object injection.

 - Contributors could edit new comments from higher-privileged users, potentially leading to a cross-site scripting.

 - User activation screen could be indexed by search engines leading to exposure of sensitive information.

 - Authors on Apache-hosted sites could upload specifically crafted files that bypass MIME verification, leading to a cross-site scripting.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
119615	WordPress < 4.9.9 / 5.x < 5.0.1 Multiple Vulnerabilities	Nessus	CGI abuses	12/13/2018	5/14/2025	critical
98371	WordPress 4.9.x < 4.9.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	12/17/2018	3/14/2023	critical
98370	WordPress 5.0.x < 5.0.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	12/17/2018	3/14/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical