WordPress Multiple Vulnerabilities

Multiple vulnerabilities have been identified in WordPress, which can be exploited by malicious users to disclose certain sensitive information or cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

1) An error in the xmlrpc.php script when expanding entity references can be exploited to exhaust memory and CPU resources via specially crafted XML data containing malicious attributes.

2) The wp-includes/class-wp-customize-widgets.php script uses the "unserialize()" function with user controlled input. This can be exploited to e.g. potentially execute arbitrary PHP code via a specially crafted serialized object.

3) The application bundles a vulnerable version of getID3().