According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

 - A flaw in $wpdb->prepare() can create unsafe queries leading to potential SQL injection flaws with plugins and themes.

 - Multiple cross-site scripting (XSS) vulnerabilities exists due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session.

 - Multiple path traversal vulnerabilities exist in the file unzipping code and customizer. A remote attacker may be able to read arbitrary files subject to the privileges under which the web server runs.

 - An open redirect flaw exists on the user and term edit screens. A remote attacker can exploit this, by tricking a user into following a specially crafted link, to redirect a user to an arbitrary website.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities :

 - Weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values.

 - When domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

根据其自我报告的版本号，检测到的 WordPress 应用程序受到多个漏洞的影响：

 - $wpdb->prepare() 中存在一个缺陷，该缺陷可创建不安全的查询，从而可能导致插件和主题中出现 SQL 注入缺陷。

 - 由于未正确审查用户提供的输入，导致存在多个跨站脚本 (XSS) 漏洞。未经身份验证的远程攻击者可利用此问题，通过特制的请求，在用户浏览器会话中执行任意脚本代码。

 - 文件解压缩代码和定制器中存在多个路径遍历漏洞。远程攻击者可以读取任意文件，这取决于 Web 服务器的运行特权。

 - 用户和术语编辑屏幕上存在公开重定向缺陷。远程攻击者可利用此漏洞，通过诱骗用户打开特别构建的链接将用户重定向到任意网站。

请注意，扫描程序并未测试这些问题，而是仅依据应用程序自我报告的版本号进行判断。

根据其自我报告的版本号，检测到的 WordPress 应用程序受到多个漏洞的影响：

 - 基于 MD5 的弱密码哈希算法使攻击者更容易通过利用访问哈希值来确定明文值。

 - 当未使用基于域的 flashmediaelement.swf 沙盒时，允许攻击者利用包含在 wp-includes/js/mediaelement/flashmediaelement.swf 文件中的代码发动跨域 Flash 注入 (XSF) 攻击。

请注意，扫描程序并未测试这些问题，而是仅依据应用程序自我报告的版本号进行判断。

ID	Name	Product	Family	Published	Updated	Severity
98304	WordPress 3.8.x < 3.8.22 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/5/2018	3/14/2023	critical
98306	WordPress 4.8.x < 4.8.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/5/2018	3/14/2023	critical
98309	WordPress 4.5.x < 4.5.11 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/5/2018	3/14/2023	critical
98310	WordPress 4.4.x < 4.4.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/5/2018	3/14/2023	critical
98313	WordPress 4.1.x < 4.1.20 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/5/2018	3/14/2023	critical
98317	WordPress 3.7.x < 3.7.23 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	11/5/2018	3/14/2023	critical
98304	WordPress 3.8.x < 3.8.22 多个漏洞	Web App Scanning	Component Vulnerability	11/5/2018	3/14/2023	critical
98306	WordPress 4.8.x < 4.8.3 多个漏洞	Web App Scanning	Component Vulnerability	11/5/2018	3/14/2023	critical
98309	WordPress 4.5.x < 4.5.11 多个漏洞	Web App Scanning	Component Vulnerability	11/5/2018	3/14/2023	critical
98310	WordPress 4.4.x < 4.4.12 多个漏洞	Web App Scanning	Component Vulnerability	11/5/2018	3/14/2023	critical
98313	WordPress 4.1.x < 4.1.20 多个漏洞	Web App Scanning	Component Vulnerability	11/5/2018	3/14/2023	critical
98317	WordPress 3.7.x < 3.7.23 多个漏洞	Web App Scanning	Component Vulnerability	11/5/2018	3/14/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical