Jon Cave

A vulnerability in Symfony's security component allows an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This issue is related to the `generateCookieHash` function in `symfony/security` and is caused by an error during the authentication process. Exploitation of this vulnerability can allow a remote attacker to bypass the authentication procedure.

A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.

The issue involves multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML. This can be achieved through vectors involving gallery shortcodes or the content of a post.

The issue makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors, due to an attempt to enable clickable links inside attributes in the wp-includes/formatting.php file.

The issue concerns an unspecified vulnerability in the wp-includes/js/swfobject.js file. The impact and attack vectors of this issue are unknown.

The issue allows remote attackers to conduct cross-site scripting (XSS) attacks. This is due to the support of offsite redirects in the wp-comments-post.php file.

The issue allows remote attackers to bypass the Same Origin Policy via crafted content, enabling scripting regardless of the domain from which the SWF content was loaded.

The issue allows remote authenticated site administrators to bypass intended access restrictions. This can be exploited to deactivate network-wide plugins.