CVE-2019-9669

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector. NOTE: It has been asserted that this is not a valid vulnerability in the context of the Wordfence WordPress plugin as the firewall rules are not maintained as part of the Wordfence software but rather it is a set of rules hosted on vendor servers and pushed to the plugin with no versioning associated. Bypassing a WAF rule doesn't make a WordPress site vulnerable (speaking in terms of software vulnerabilities)

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.edgescan.com/popular-wordpress-waf-bypass-zeroday-discovered-by-edgescan/Exploit, Third Party Advisory
https://www.edgescan.com/popular-wordpress-waf-bypass-zeroday-discovered-by-edgescan/Exploit, Third Party Advisory

Timeline

Published: Apr 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-96709.8mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as CVE-2019-96738.8Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI.CVE-2019-96747.5Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.CVE-2019-96758.1An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow v CVE-2019-96767.8Buffer overflow vulnerability found in some Dahua IP Camera devices IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Build before 2018/11. The vulnerabil CVE-2019-96779.8The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructi CVE-2019-96787.5Some Dahua products have the problem of denial of service during the login process. An attacker can cause a device crashed by constructing a CVE-2019-96798.8Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affecte CVE-2019-96805.3Some Dahua products have information leakage issues. Attackers can obtain the IP address and device model information of the device by const CVE-2019-96815.3Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing CVE-2019-96828.1Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal CVE-2019-96868.8pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL "pacman -U <url>" due to an unsanitized