在新兴的 Snyk 平台上检测 PHP 应用程序的漏洞

如果您等不及，请使用此网址：
https://snyk.io/login?token=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx&utm_medium=cli&utm_source=cli&utm_campaign=HOMEBREW&os=darwin&docker=false

您的帐号已通过身份验证。Snyk现在可以使用了。

正在测试/Users/bezeklik/Workspace/snyk…

组织：bezeklik
软件包管理器：composer
目标文件：composer.lock
项目名称：snyk
开源：否
项目路径：/Users/bezeklik/Workspace/snyk
许可证：已启用

✔ 对5个依赖项进行了已知问题测试，未发现易受攻击的路径。

下一步：
– 运行`snyk monitor`以接收有关新相关漏洞的通知。
– 运行`snyk test`作为您的CI/测试的一部分。

✗ [Low] XML External Entity (XXE) Injection
Path: wordpress/wp-includes/atomlib.php, line 173
Info: Unsanitized input from data from a remote resource flows to xml_parse. This may result in an XXE vulnerability. You may be vulnerable if using an old version of PHP (<8.0)

✗ [Medium] Open Redirect
Path: wordpress/wp-includes/js/backbone.js, line 2032
Info: Unsanitized input from the document location flows into replace, where it is used as an URL to redirect the user. This may result in an Open Redirect vulnerability.

✗ [Medium] Open Redirect
Path: wordpress/wp-admin/js/privacy-tools.js, line 91
Info: Unsanitized input from data from a remote resource flows into window.location, where it is used as an URL to redirect the user. This may result in an Open Redirect vulnerability.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-login.php, line 672
Info: setcookie has the Secure attribute set to false. Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Open Redirect
Path: wordpress/wp-includes/ms-settings.php, line 79
Info: Unsanitized input from an HTTP header flows into header, where it is used as an URL to redirect the user. This may result in an Open Redirect vulnerability.

✗ [Medium] Open Redirect
Path: wordpress/wp-includes/pluggable.php, line 1343
Info: Unsanitized input from an HTTP header flows into header, where it is used as an URL to redirect the user. This may result in an Open Redirect vulnerability.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/comment.php, line 577
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/comment.php, line 578
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/comment.php, line 579
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1031
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1032
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1033
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1034
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1035
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1036
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1039
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1040
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1043
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1044
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1045
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1046
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1049
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1050
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1051
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1052
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/pluggable.php, line 1055
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/option.php, line 1274
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/class-wp-recovery-mode-cookie-service.php, line 62
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
Path: wordpress/wp-includes/class-wp-recovery-mode-cookie-service.php, line 63
Info: setcookie misses the Secure attribute (it is false by default). Set it to true to protect the cookie from man-in-the-middle attacks.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-login.php, line 416
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-login.php, line 419
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-login.php, line 672
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/comment.php, line 577
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/comment.php, line 578
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/comment.php, line 579
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/comment.php, line 595
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/comment.php, line 596
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/comment.php, line 597
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1031
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1032
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1033
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1034
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1035
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1036
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1039
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1040
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1043
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1044
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1045
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1046
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1049
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1050
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1051
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1052
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/pluggable.php, line 1055
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/option.php, line 1097
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/option.php, line 1098
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/option.php, line 1274
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/class-wp-recovery-mode-cookie-service.php, line 62
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-includes/class-wp-recovery-mode-cookie-service.php, line 63
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Sensitive Cookie Without ‘HttpOnly’ Flag
Path: wordpress/wp-admin/post.php, line 231
Info: setcookie misses the HttpOnly attribute (it is false by default). Set it to true to protect the cookie from possible malicious code on client side.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/pluggable.php, line 2432
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/pluggable.php, line 2565
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/pluggable.php, line 2568
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/l10n.php, line 1105
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ms-files.php, line 59
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/dashboard.php, line 1155
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/dashboard.php, line 1256
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/dashboard.php, line 1765
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/plugin-install.php, line 246
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-snoopy.php, line 1218
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp.php, line 461
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/update-core.php, line 559
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/update-core.php, line 733
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp-theme.php, line 217
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/class-wp-ms-themes-list-table.php, line 512
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-phpass.php, line 83
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-phpass.php, line 84
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-phpass.php, line 152
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-phpass.php, line 154
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/image.php, line 504
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/plugin.php, line 1338
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/rss.php, line 813
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/SimplePie/Caption.php, line 120
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp-text-diff-renderer-table.php, line 453
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp-text-diff-renderer-table.php, line 454
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp-text-diff-renderer-table.php, line 467
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp-embed.php, line 232
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ms-site.php, line 965
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/SimplePie/Copyright.php, line 92
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/SimplePie/Cache/Memcached.php, line 95
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ID3/module.tag.apetag.php, line 314
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp-term-query.php, line 740
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/SimplePie/Author.php, line 102
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/schema.php, line 1078
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/cron.php, line 122
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/cron.php, line 302
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/cron.php, line 510
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/cron.php, line 600
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/cron.php, line 762
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/cron.php, line 1224
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ms-blogs.php, line 135
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ms-blogs.php, line 153
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ms-blogs.php, line 269
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/SimplePie/Category.php, line 115
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp-oembed-controller.php, line 174
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ms-functions.php, line 355
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ms-functions.php, line 374
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ms-functions.php, line 378
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ms-functions.php, line 788
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ms-functions.php, line 857
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ms-functions.php, line 2815
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-simplepie.php, line 736
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/rest-api/endpoints/class-wp-rest-pattern-directory-controller.php, line 125
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/misc.php, line 1347
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/misc.php, line 1451
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-pop3.php, line 190
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp-comment-query.php, line 432
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp-comment-query.php, line 999
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp-site-query.php, line 339
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/upgrade.php, line 952
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/SimplePie/Credit.php, line 101
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp-network-query.php, line 248
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/file.php, line 518
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/SimplePie/Restriction.php, line 101
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/import.php, line 143
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/bookmark.php, line 153
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/SimplePie/Enclosure.php, line 271
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/SimplePie/Source.php, line 73
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/SimplePie/Item.php, line 116
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/PHPMailer/SMTP.php, line 640
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/PHPMailer/SMTP.php, line 648
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/default-constants.php, line 232
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/class-wp-community-events.php, line 315
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/class-wp-community-events.php, line 317
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/class-wp-plugins-list-table.php, line 951
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/SimplePie/Cache/Memcache.php, line 99
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php, line 1002
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/SimplePie/Rating.php, line 92
Info: MD5 hash (used in md5) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/pluggable.php, line 2566
Info: SHA1 hash (used in sha1) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/pluggable.php, line 2567
Info: SHA1 hash (used in sha1) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp-recovery-mode-cookie-service.php, line 141
Info: SHA1 hash (used in sha1) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp-session-tokens.php, line 74
Info: SHA1 hash (used in sha1) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/pluggable.php, line 2350
Info: md5 hash (used in hash_hmac) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/pluggable.php, line 2373
Info: md5 hash (used in hash_hmac) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/PHPMailer/SMTP.php, line 627
Info: md5 hash (used in hash_hmac) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ID3/getid3.php, line 1669
Info: MD5 hash (used in md5_file) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ID3/getid3.php, line 1699
Info: MD5 hash (used in md5_file) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/update-core.php, line 1120
Info: MD5 hash (used in md5_file) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/update-core.php, line 1224
Info: MD5 hash (used in md5_file) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/file.php, line 1258
Info: MD5 hash (used in md5_file) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-admin/includes/class-core-upgrader.php, line 411
Info: MD5 hash (used in md5_file) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php, line 1188
Info: MD5 hash (used in md5_file) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/class-wp-recovery-mode-cookie-service.php, line 232
Info: sha1 hash (used in hash_hmac) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ID3/getid3.php, line 664
Info: md5 hash (used in getHashdata) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ID3/getid3.php, line 670
Info: sha1 hash (used in getHashdata) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ID3/getid3.php, line 1673
Info: SHA1 hash (used in sha1_file) is insecure. Consider changing it to a secure hashing algorithm.

✗ [Medium] Use of Password Hash With Insufficient Computational Effort
Path: wordpress/wp-includes/ID3/getid3.php, line 1703
Info: SHA1 hash (used in sha1_file) is insecure. Consider changing it to a secure hashing algorithm.

✗ [High] File Inclusion
Path: wordpress/wp-includes/blocks.php, line 99
Info: Unsanitized input from data from a remote resource flows into _, where it is included dynamically. Allowing unvalidated user input to control files that are included dynamically in PHP can lead to malicious code execution.

✗ [High] File Inclusion
Path: wordpress/wp-includes/ID3/getid3.php, line 632
Info: Unsanitized input from data from a remote resource flows into _, where it is included dynamically. Allowing unvalidated user input to control files that are included dynamically in PHP can lead to malicious code execution.

✗ [High] File Inclusion
Path: wordpress/wp-admin/admin.php, line 291
Info: Unsanitized input from an HTTP parameter flows into _, where it is included dynamically. Allowing unvalidated user input to control files that are included dynamically in PHP can lead to malicious code execution.

✗ [High] File Inclusion
Path: wordpress/wp-admin/admin.php, line 293
Info: Unsanitized input from an HTTP parameter flows into _, where it is included dynamically. Allowing unvalidated user input to control files that are included dynamically in PHP can lead to malicious code execution.

✗ [High] File Inclusion
Path: wordpress/wp-admin/update.php, line 100
Info: Unsanitized input from an HTTP parameter flows into _, where it is included dynamically. Allowing unvalidated user input to control files that are included dynamically in PHP can lead to malicious code execution.

✗ [High] SQL Injection
Path: wordpress/wp-admin/includes/class-wp-list-table.php, line 617
Info: Unsanitized input from an HTTP parameter flows into prepare, where it is used in an SQL query. This may result in an SQL Injection vulnerability.

✗ [High] SQL Injection
Path: wordpress/wp-admin/user-edit.php, line 108
Info: Unsanitized input from an HTTP parameter flows into query, where it is used in an SQL query. This may result in an SQL Injection vulnerability.

✗ [High] SQL Injection
Path: wordpress/wp-admin/user-edit.php, line 159
Info: Unsanitized input from an HTTP parameter flows into query, where it is used in an SQL query. This may result in an SQL Injection vulnerability.

✗ [High] SQL Injection
Path: wordpress/wp-includes/comment.php, line 1189
Info: Unsanitized input from an HTTP parameter flows into query, where it is used in an SQL query. This may result in an SQL Injection vulnerability.

✗ [High] SQL Injection
Path: wordpress/wp-admin/setup-config.php, line 317
Info: Unsanitized input from an HTTP parameter flows into query, where it is used in an SQL query. This may result in an SQL Injection vulnerability.

✗ [High] SQL Injection
Path: wordpress/wp-includes/comment.php, line 2933
Info: Unsanitized input from the database flows into query, where it is used in an SQL query. This may result in an SQL Injection vulnerability.

✗ [High] SQL Injection
Path: wordpress/wp-includes/comment.php, line 3128
Info: Unsanitized input from the database flows into query, where it is used in an SQL query. This may result in an SQL Injection vulnerability.

✗ [High] SQL Injection
Path: wordpress/wp-includes/comment.php, line 3129
Info: Unsanitized input from the database flows into query, where it is used in an SQL query. This may result in an SQL Injection vulnerability.

✗ [High] Server-Side Request Forgery (SSRF)
Path: wordpress/wp-admin/includes/class-file-upload-upgrader.php, line 128
Info: Unsanitized input from an HTTP parameter flows into unlink, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.

✗ [High] Server-Side Request Forgery (SSRF)
Path: wordpress/wp-includes/class-wp-image-editor-gd.php, line 98
Info: Unsanitized input from data from a remote resource flows into file_get_contents, where it is used as an URL to perform a request. This may result in a Server-Side Request Forgery vulnerability.

✗ [High] Path Traversal
Path: wordpress/wp-includes/class-wp-image-editor-gd.php, line 98
Info: Unsanitized input from data from a remote resource flows into file_get_contents, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.

✗ [High] Path Traversal
Path: wordpress/wp-admin/includes/class-file-upload-upgrader.php, line 128
Info: Unsanitized input from an HTTP parameter flows into unlink, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to delete arbitrary files.

✗ [High] Path Traversal
Path: wordpress/wp-includes/l10n.php, line 1169
Info: Unsanitized input from an HTTP parameter flows into file_get_contents, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.

✗ [High] Path Traversal
Path: wordpress/wp-includes/ms-files.php, line 87
Info: Unsanitized input from an HTTP parameter flows into readfile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files.

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-login.php, line 221
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/user-edit.php, line 584
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/rest-api/class-wp-rest-server.php, line 513
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-signup.php, line 116
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-signup.php, line 149
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-signup.php, line 261
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-signup.php, line 272
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-signup.php, line 278
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/media.php, line 2075
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/media.php, line 2346
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/media.php, line 2414
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/media.php, line 2592
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/media.php, line 2608
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/media.php, line 2740
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/media.php, line 2832
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/media.php, line 2902
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/network/sites.php, line 388
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/class-wp-users-list-table.php, line 403
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/network/site-info.php, line 171
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/install.php, line 432
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/nav-menus.php, line 720
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/nav-menus.php, line 1006
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/plugin-install.php, line 621
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/plugin-install.php, line 654
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/plugin-install.php, line 656
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/plugin-install.php, line 673
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/plugin-install.php, line 695
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/plugin-install.php, line 700
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/plugin-install.php, line 766
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/plugin-install.php, line 847
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/plugin-install.php, line 860
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/plugin-install.php, line 872
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/theme-editor.php, line 285
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/async-upload.php, line 67
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/async-upload.php, line 72
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/async-upload.php, line 88
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/async-upload.php, line 98
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/async-upload.php, line 155
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/widgets-form.php, line 302
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/blocks/legacy-widget.php, line 119
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/load.php, line 1598
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/load.php, line 1605
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/authorize-application.php, line 140
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/network/upgrade.php, line 124
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/network/upgrade.php, line 128
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/comment-template.php, line 73
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/comment-template.php, line 254
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/comment-template.php, line 1028
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/comment-template.php, line 1974
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/comment-template.php, line 2704
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/plugins.php, line 641
Info: Unsanitized input from an HTTP parameter flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/includes/dashboard.php, line 1732
Info: Unsanitized input from an HTTP header flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/js/tinymce/wp-tinymce.php, line 38
Info: Unsanitized input from data from a remote resource flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/js/tinymce/wp-tinymce.php, line 41
Info: Unsanitized input from data from a remote resource flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/js/tinymce/wp-tinymce.php, line 42
Info: Unsanitized input from data from a remote resource flows into the echo statement, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

✗ [High] Regular Expression Denial of Service (ReDoS)
Path: wordpress/wp-includes/class-snoopy.php, line 322
Info: Unsanitized user input from an HTTP parameter flows into preg_match, where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack (reDOS).

✗ [High] Regular Expression Denial of Service (ReDoS)
Path: wordpress/wp-includes/class-snoopy.php, line 389
Info: Unsanitized user input from an HTTP parameter flows into preg_match, where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack (reDOS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/nav-menu.js, line 1354
Info: Unsanitized input from data from a remote resource flows into html, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/js/plupload/handlers.js, line 90
Info: Unsanitized input from data from a remote resource flows into html, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/js/plupload/handlers.js, line 207
Info: Unsanitized input from data from a remote resource flows into html, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/js/plupload/handlers.js, line 221
Info: Unsanitized input from data from a remote resource flows into html, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/site-health.js, line 168
Info: Unsanitized input from data from a remote resource flows into html, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/image-edit.js, line 540
Info: Unsanitized input from data from a remote resource flows into html, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/image-edit.js, line 549
Info: Unsanitized input from data from a remote resource flows into html, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/image-edit.js, line 557
Info: Unsanitized input from data from a remote resource flows into html, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/image-edit.js, line 627
Info: Unsanitized input from data from a remote resource flows into html, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/inline-edit-post.js, line 443
Info: Unsanitized input from data from a remote resource flows into html, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/dashboard.js, line 151
Info: Unsanitized input from data from a remote resource flows into html, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/inline-edit-tax.js, line 232
Info: Unsanitized input from data from a remote resource flows into html, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/post.js, line 239
Info: Unsanitized input from data from a remote resource flows into html, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/post.js, line 1019
Info: Unsanitized input from data from a remote resource flows into html, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-includes/js/plupload/handlers.js, line 135
Info: Unsanitized input from data from a remote resource flows into append, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/site-health.js, line 171
Info: Unsanitized input from data from a remote resource flows into append, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/image-edit.js, line 483
Info: Unsanitized input from data from a remote resource flows into append, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/post.js, line 68
Info: Unsanitized input from data from a remote resource flows into append, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/tags.js, line 138
Info: Unsanitized input from data from a remote resource flows into after, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/tags.js, line 155
Info: Unsanitized input from data from a remote resource flows into after, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/tags-box.js, line 315
Info: Unsanitized input from data from a remote resource flows into after, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/tags.js, line 141
Info: Unsanitized input from data from a remote resource flows into prepend, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/inline-edit-post.js, line 432
Info: Unsanitized input from data from a remote resource flows into before, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/inline-edit-tax.js, line 209
Info: Unsanitized input from data from a remote resource flows into before, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/updates.js, line 2540
Info: Unsanitized input from the document location flows into append, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/updates.js, line 2563
Info: Unsanitized input from the document location flows into append, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/updates.js, line 2649
Info: Unsanitized input from the document location flows into append, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Cross-site Scripting (XSS)
Path: wordpress/wp-admin/js/updates.js, line 2547
Info: Unsanitized input from the document location flows into prepend, where it is used to dynamically construct the HTML page on client side. This may result in a DOM Based Cross-Site Scripting attack (DOMXSS).

✗ [High] Code Injection
Path: wordpress/wp-includes/js/customize-preview.js, line 859
Info: Unsanitized input from the document location flows into setInterval, where it is executed as JavaScript code. This may result in a Code Injection vulnerability.

✔ Test completed

Organization: undefined
Test type: Static code analysis
Project path: /Users/bezeklik/Workspace/snyk

263 Code issues found
105 [High] 157 [Medium] 1 [Low]