CVE-2018-20150

Description

References

• securityfocus.com/bid/106220 · Third Party Advisory
• codex.wordpress.org/Version_4.9.9 · Product
• WordPress/WordPress commit fb3c6ea · Patch
• lists.debian.org/debian-lts-announce/2019/02/msg00019.html · Mailing List
• wordpress.org/news/2018/12/wordpress-5-0-1-security-release · Release Notes
• wordpress.org/support/wordpress-version/version-5-0-1 · Release Notes
• wpvulndb.com/vulnerabilities/9173 · Vendor Advisory
• debian.org/security/2019/dsa-4401 · Third Party Advisory
• zdnet.com/article/wordpress-plugs-bug-that-led-to-google-indexing-some-user-passwords · Press/Media Coverage

wordpress 的其他漏洞

• CVE-2026-87902高危 8.1EXPLOITED (CISA KEV)An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the …
• CVE-2026-63030严重 9.8EXPLOITED (CISA KEV)WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the …
• CVE-2026-60137中危 5.9EXPLOITED (CISA KEV)WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query…
• CVE-2022-4973中危 5.4WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with acce…
• CVE-2024-4439中危 6.1WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due t…