WordPress wordpress has 345 known advisories in the phpwarden feed, 2 actively exploited. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-63030 KEV | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the | critical | 9.8 | >=6.9 and <6.9.5 or >=7.0 and <7.0.2 | 6.9.5, 7.0.2 |
| CVE-2026-60137 KEV | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query | medium | 5.9 | >=6.8 and <6.8.6 or >=6.9 and <6.9.5 or >=7.0 and <7.0.2 | 6.8.6, 6.9.5, 7.0.2 |
| CVE-2022-21661 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitizatio | high | 8.0 | >=3.7 and <3.7.37 or >=3.8 and <3.8.37 or >=3.9 and <3.9.35 or >=4.0 and <4.0.34 or >=4.1 and <4.1.34 or >=4.2 and <4.2.31 or >=4.3 and <4.3.27 or >=4.4 and <4.4.26 or >=4.5 and <4.5.25 or >=4.6 and <4.6.22 or >=4.7 and <4.7.22 or >=4.8 and <4.8.18 or >=4.9 and <4.9.19 or >=5.0 and <5.0.15 or >=5.1 and <5.1.12 or >=5.2 and <5.2.14 or >=5.3 and <5.3.11 or >=5.4 and <5.4.9 or >=5.5 and <5.5.8 or >=5.6 and <5.6.7 or >=5.7 and <5.7.5 or >=5.8 and <5.8.3 | 3.7.37, 3.8.37, 3.9.35, 4.0.34 |
| CVE-2019-8943 | WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output ima | medium | 6.5 | <=5.0.3 | – |
| CVE-2017-5487 | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not prop | medium | 5.3 | <=4.7 | – |
| CVE-2021-29447 | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Libr | high | 7.1 | >=5.6.0 and <5.7.1 | 5.7.1 |
| CVE-2009-2335 | WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, | medium | 5.0 | <2.8.1 | 2.8.1 |
| CVE-2017-1001000 | The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before | high | 7.5 | =4.7 or =4.7.1 or =4.7.2 | – |
| CVE-2014-9034 | wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers | medium | 5.0 | <=3.7.4 or =3.8 or =3.8.1 or =3.8.2 or =3.8.3 or =3.8.4 or =3.9 or =3.9.1 or =3.9.2 or =4.0 | – |
| CVE-2019-8942 | WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an a | high | 8.8 | <4.9.9 or =5.0 | 4.9.9 |
| CVE-2023-2745 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthen | medium | 5.4 | <4.1.38 or >=4.2 and <4.2.35 or >=4.3 and <4.3.31 or >=4.4 and <4.4.30 or >=4.5 and <4.5.29 or >=4.6 and <4.6.26 or >=4.7 and <4.7.26 or >=4.8 and <4.8.22 or >=4.9 and <4.9.23 or >=5.0 and <5.0.19 or >=5.1 and <5.1.16 or >=5.2 and <5.2.18 or >=5.3 and <5.3.15 or >=5.4 and <5.4.13 or >=5.5 and <5.5.12 or >=5.6 and <5.6.11 or >=5.7 and <5.7.9 or >=5.8 and <5.8.7 or >=5.9 and <5.9.6 or >=6.0 and <6.0.4 or >=6.1 and <6.1.2 or =6.2 | 4.1.38, 4.2.35, 4.3.31, 4.4.30 |
| CVE-2018-6389 | In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of regist | high | 7.5 | <=4.9.2 | – |
| CVE-2024-4439 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due t | high | 7.2 | >=6.0 and <=6.0.7 or >=6.1 and <=6.1.5 or >=6.2 and <=6.2.4 or >=6.3 and <=6.3.3 or >=6.4.0 and <=6.4.3 or >=6.5 and <=6.5.1 | – |
| CVE-2022-21662 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticate | high | 8.0 | <5.8.3 | 5.8.3 |
| CVE-2018-12895 | WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb param | high | 8.8 | <4.9.7 | 4.9.7 |
| CVE-2005-2612 | Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remote attackers to execute arbitrary PHP code via the cache_las | high | 7.5 | =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 | – |
| CVE-2019-9787 | WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default conf | high | 8.8 | <5.1.1 | 5.1.1 |
| CVE-2016-6896 | Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remo | high | 7.1 | =4.5.3 | – |
| CVE-2019-17671 | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled. | medium | 5.3 | <5.2.4 | 5.2.4 |
| CVE-2013-0235 | The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attack | medium | 6.4 | <=3.5.0 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 | – |
| CVE-2021-44223 | WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via | high | 8.1 | <5.8 | 5.8 |
| CVE-2016-6897 | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress bef | medium | 6.5 | <=4.5.5 | – |
| CVE-2007-1277 | WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backd | high | 7.5 | =2.1.1 | – |
| CVE-2018-20148 | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMedi | critical | 9.8 | <4.9.9 or >=5.0 and <5.0.1 | 4.9.9, 5.0.1 |
| CVE-2017-8295 | WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to re | medium | 5.9 | <=4.7.4 | – |
| CVE-2014-5266 | The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the numb | medium | 5.0 | <=3.9.1 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 or =3.5.0 or =3.5.1 or =3.6 or =3.6.1 or =3.7 or =3.7.1 or =3.8 or =3.8.1 or =3.9.0 | – |
| CVE-2009-2762 | wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly t | high | 7.5 | <=2.8.3 | – |
| CVE-2015-3440 | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web | medium | 4.3 | <=4.2 | – |
| CVE-2020-28032 | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. | critical | 9.8 | <5.5.2 | 5.5.2 |
| CVE-2018-14028 | In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once | high | 7.2 | =4.9.7 | – |
| CVE-2006-2667 | Direct static code injection vulnerability in WordPress 2.0.2 and earlier allows remote attackers to execute arbitrary commands by inserting | high | 7.5 | <=2.0.2 | – |
| CVE-2020-11027 | In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be | medium | 6.1 | >=3.7 and <3.7.33 or >=3.8 and <3.8.33 or >=3.9 and <3.9.31 or >=4.0 and <4.0.30 or >=4.1 and <4.1.30 or >=4.2 and <4.2.27 or >=4.3 and <4.3.23 or >=4.4 and <4.4.22 or >=4.5 and <4.5.21 or >=4.6 and <4.6.18 or >=4.7 and <4.7.17 or >=4.8 and <4.8.13 or >=4.9 and <4.9.14 or >=5.0 and <5.0.9 or >=5.1 and <5.1.5 or >=5.2 and <5.2.6 or >=5.3 and <5.3.3 or =5.4 | 3.7.33, 3.8.33, 3.9.31, 4.0.30 |
| CVE-2017-14719 | Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip componen | high | 7.5 | =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4 or =3.4.1 or =3.4.2 or =3.5 or =3.5.1 or =3.5.2 or =3.6 or =3.6.1 or =3.7 or =3.7.1 or =3.7.2 or =3.7.3 or =3.7.4 or =3.7.5 or =3.7.6 or =3.7.7 or =3.7.8 or =3.7.9 or =3.7.10 or =3.7.11 or =3.7.12 or =3.7.13 or =3.7.14 or =3.7.15 or =3.7.16 or =3.7.17 or =3.7.18 or =3.7.19 or =3.7.20 or =3.7.21 or =3.7.22 or =3.8 or =3.8.1 or =3.8.2 or =3.8.3 or =3.8.4 or =3.8.5 or =3.8.6 or =3.8.7 or =3.8.8 or =3.8.9 or =3.8.10 or =3.8.11 or =3.8.12 or =3.8.13 or =3.8.14 or =3.8.15 or =3.8.16 or =3.8.17 or =3.8.18 or =3.8.19 or =3.8.20 or =3.8.21 or =3.8.22 or =3.9 or =3.9.1 or =3.9.2 or =3.9.3 or =3.9.4 or =3.9.5 or =3.9.6 or =3.9.7 or =3.9.8 or =3.9.9 or =3.9.10 or =3.9.11 or =3.9.12 or =3.9.13 or =3.9.14 or =3.9.15 or =3.9.16 or =3.9.17 or =3.9.18 or =3.9.19 or =3.9.20 or =4.0 or =4.0.1 or =4.0.2 or =4.0.3 or =4.0.4 or =4.0.5 or =4.0.6 or =4.0.7 or =4.0.8 or =4.0.9 or =4.0.10 or =4.0.11 or =4.0.12 or =4.0.13 or =4.0.14 or =4.0.15 or =4.0.16 or =4.0.17 or =4.0.18 or =4.0.19 or =4.1 or =4.1.1 or =4.1.2 or =4.1.3 or =4.1.4 or =4.1.5 or =4.1.6 or =4.1.7 or =4.1.8 or =4.1.9 or =4.1.10 or =4.1.11 or =4.1.12 or =4.1.13 or =4.1.14 or =4.1.15 or =4.1.16 or =4.1.17 or =4.1.18 or =4.1.19 or =4.2 or =4.2.1 or =4.2.2 or =4.2.3 or =4.2.4 or =4.2.5 or =4.2.6 or =4.2.7 or =4.2.8 or =4.2.9 or =4.2.10 or =4.2.11 or =4.2.12 or =4.2.13 or =4.2.14 or =4.2.15 or =4.2.16 or =4.3 or =4.3.1 or =4.3.2 or =4.3.3 or =4.3.4 or =4.3.5 or =4.3.6 or =4.3.7 or =4.3.8 or =4.3.9 or =4.3.10 or =4.3.11 or =4.3.12 or =4.4 or =4.4.1 or =4.4.2 or =4.4.3 or =4.4.4 or =4.4.5 or =4.4.6 or =4.4.7 or =4.4.8 or =4.4.9 or =4.4.10 or =4.4.11 or =4.5 or =4.5.1 or =4.5.2 or =4.5.3 or =4.5.4 or =4.5.5 or =4.5.6 or =4.5.7 or =4.5.8 or =4.5.9 or =4.5.10 or =4.6 or =4.6.1 or =4.6.2 or =4.6.3 or =4.6.4 or =4.6.5 or =4.6.6 or =4.6.7 or =4.7 or =4.7.1 or =4.7.2 or =4.7.3 or =4.7.4 or =4.7.5 or =4.8 or =4.8.1 | – |
| CVE-2008-5695 | wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, | high | 8.5 | <=2.3.2 | – |
| CVE-2007-0107 | WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote | medium | 6.8 | <=2.0.5 | – |
| CVE-2007-0233 | wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a va | high | 7.5 | =0.6.2 or =0.6.2.1 or =0.7 or =0.71 or =1.2 or =1.2.1 or =1.2.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 | – |
| CVE-2004-1584 | CRLF injection vulnerability in wp-login.php in WordPress 1.2 allows remote attackers to perform HTTP Response Splitting attacks to modify e | medium | 5.0 | =1.2 | – |
| CVE-2017-5611 | SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbit | critical | 9.8 | <=4.7.1 | – |
| CVE-2010-0682 | WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p p | medium | 4.0 | =2.9 or =2.9.1 | – |
| CVE-2015-2213 | SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attacke | high | 7.5 | <=4.2.3 | – |
| CVE-2005-2108 | SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via | high | 7.5 | =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.5 or =1.5.1 or =1.5.1.2 | – |
| CVE-2011-4898 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacki | medium | 5.0 | <=3.3.1 or =0.7 or =0.71 or =0.72 or =0.711 or =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.2.1 or =1.2.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.6 or =2.9 or =2.9.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2.1 or =3.3 | – |
| CVE-2014-0166 | The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determi | medium | 6.4 | <=3.7.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 or =3.5.0 or =3.5.1 or =3.6 or =3.6.1 or =3.7 or =3.8 or =3.8.1 | – |
| CVE-2007-6318 | SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute arbitrary SQL command | medium | 6.8 | =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.10 or =2.0.10_rc1 or =2.0.10_rc2 or =2.1.1 or =2.1.2 or =2.1.3 or =2.1.3_rc1 or =2.1.3_rc2 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.2_revision5002 or =2.2_revision5003 or =2.3 or =2.3.1 | – |
| CVE-2012-3414 | Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image | medium | 4.3 | <=3.3.1 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 | – |
| CVE-2011-4899 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database ser | high | 7.5 | <=3.3.1 or =0.7 or =0.71 or =0.72 or =0.711 or =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.2.1 or =1.2.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.6 or =2.9 or =2.9.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2.1 or =3.3 | – |
| CVE-2008-4769 | Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, al | high | 9.3 | <=2.3.3 or =0.6.2 or =0.6.2.1 or =0.7 or =0.71 or =0.71-gold or =0.72 or =0.711 or =1.0 or =1.0-platinum or =1.0.1 or =1.0.1-miles or =1.0.2 or =1.0.2-blakey or =1.2 or =1.2-delta or =1.2-mingus or =1.2.1 or =1.2.2 or =1.3.1 or =1.4 or =1.5 or =1.5-strayhorn or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.10_rc1 or =2.0.10_rc2 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.1.3_rc1 or =2.1.3_rc2 or =2.2 or =2.2.0 or =2.2.1 or =2.2.2 or =2.2.3 or =2.2_revision5002 or =2.2_revision5003 or =2.3 or =2.3.1 or =2.3.2 or =2.5 | – |
| CVE-2013-4338 | wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attack | high | 7.5 | <=3.6 | – |
| CVE-2012-2399 | Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image | high | 10.0 | <=3.3.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.3 | – |
| CVE-2009-3890 | Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a cert | medium | 6.0 | <=2.8.5 | – |
| CVE-2018-1000773 | WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code | high | 8.8 | <=4.9.8 | – |
| CVE-2020-28037 | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which | critical | 9.8 | <5.5.2 | 5.5.2 |
| CVE-2009-2851 | Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrar | medium | 4.3 | <=2.8.1 | – |
| CVE-2016-2222 | The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request f | high | 8.6 | =4.4.1 | – |
| CVE-2015-5623 | WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access | medium | 4.0 | <=4.2.2 | – |
| CVE-2007-0540 | WordPress allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source UR | medium | 5.0 | <=2.0 | – |
| CVE-2012-0937 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to ex | medium | 5.0 | <=3.3.1 or =0.7 or =0.71 or =0.72 or =0.711 or =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.2.1 or =1.2.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.6 or =2.9 or =2.9.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2.1 or =3.3 | – |
| CVE-2013-4339 | WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redi | high | 7.5 | <=3.6 | – |
| CVE-2007-1244 | Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileg | medium | 6.8 | <=2.1.1 | – |
| CVE-2015-3438 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attacker | medium | 4.3 | <=4.1.1 | – |
| CVE-2016-4567 | Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, | medium | 6.1 | <=4.5.1 | – |
| CVE-2015-5730 | The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time c | medium | 5.0 | <=4.2.3 | – |
| CVE-2007-3140 | SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a paramet | medium | 6.5 | =2.2 | – |
| CVE-2007-1897 | SQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute ar | medium | 6.5 | <=2.1.2 or =2.1 or =2.1.1 | – |
| CVE-2017-14722 | Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename. | high | 7.5 | =4.7 or =4.7.1 or =4.7.2 or =4.7.3 or =4.7.4 or =4.7.5 or =4.8 or =4.8.1 | – |
| CVE-2015-5732 | Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPres | medium | 4.3 | <=4.2.3 | – |
| CVE-2017-17091 | wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which al | high | 8.8 | <=4.9 | – |
| CVE-2007-5710 | Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inject arbitrary web scr | low | 2.6 | =2.3 | – |
| CVE-2015-5714 | Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leverag | medium | 6.1 | <=4.3.0 | – |
| CVE-2006-6808 | Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script | medium | 6.8 | <=2.0.5 or =0.6.2 or =0.6.2.1 or =0.7 or =0.71 or =1.2 or =1.2.1 or =1.2.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 | – |
| CVE-2017-16510 | WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL inje | critical | 9.8 | <=4.8.2 | – |
| CVE-2015-5734 | Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allow | medium | 4.3 | <=4.2.3 | – |
| CVE-2017-14723 | Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly addre | critical | 9.8 | <=4.8.1 | – |
| CVE-2007-1049 | Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for Wor | medium | 4.3 | =0.6.2 or =0.6.2.1 or =0.7 or =0.71 or =1.2.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =1.2 or =1.2.1 | – |
| CVE-2004-1559 | Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the ( | medium | 4.3 | =1.2 | – |
| CVE-2015-5715 | The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authentic | medium | 4.3 | <=4.3.0 | – |
| CVE-2009-2334 | wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of | medium | 4.9 | <=2.7.1 or =0.6.2 or =0.6.2.1 or =0.7 or =0.71 or =0.71-gold or =0.72 or =0.711 or =1.0 or =1.0-platinum or =1.0.1 or =1.0.1-miles or =1.0.2 or =1.0.2-blakey or =1.2 or =1.2-delta or =1.2-mingus or =1.2.1 or =1.2.2 or =1.3.1 or =1.4 or =1.5 or =1.5-strayhorn or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.10_rc1 or =2.0.10_rc2 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.1.3_rc1 or =2.1.3_rc2 or =2.2 or =2.2.0 or =2.2.1 or =2.2.2 or =2.2.3 or =2.2_revision5002 or =2.2_revision5003 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.3 or =2.6.5 | – |
| CVE-2016-4566 | Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote at | medium | 6.1 | <=4.5.1 | – |
| CVE-2007-1622 | Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows | medium | 4.3 | =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.10 or =2.0.10_rc1 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3_rc1 | – |
| CVE-2009-3622 | Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU | medium | 4.3 | <=2.8.4 | – |
| CVE-2018-20151 | In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual config | high | 7.5 | <4.9.9 or >=5.0 and <5.0.1 | 4.9.9, 5.0.1 |
| CVE-2008-4106 | WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of t | medium | 5.1 | <=2.6.1 or =0.71-gold or =1.0-platinum or =1.0.1-miles or =1.0.2-blakey or =1.2-delta or =1.2-mingus or =1.2.1 or =1.2.2 or =1.5-strayhorn or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.5 or =2.5.1 or =2.6 | – |
| CVE-2009-2336 | The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whet | medium | 5.0 | <2.8.1 | 2.8.1 |
| CVE-2019-17669 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of | critical | 9.8 | <5.2.4 | 5.2.4 |
| CVE-2020-28036 | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. | critical | 9.8 | <5.5.2 | 5.5.2 |
| CVE-2017-5610 | wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assign | medium | 5.3 | <=4.7.1 | – |
| CVE-2007-2821 | SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via | high | 7.5 | <=2.1.3 | – |
| CVE-2019-16223 | WordPress before 5.2.3 allows XSS in post previews by authenticated users. | medium | 5.4 | <5.2.3 | 5.2.3 |
| CVE-2015-3439 | Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3 | medium | 4.3 | =3.9.0 or =3.9.1 or =3.9.2 or =3.9.3 or =4.0 or =4.0.1 or =4.1 or =4.1.1 | – |
| CVE-2008-0192 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.0.9 and earlier allow remote attackers to inject arbitrary web script or | medium | 4.3 | <=2.0.9 | – |
| CVE-2008-1930 | The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXPIRY_TIME, which allow | high | 7.5 | =2.5 | – |
| CVE-2008-1304 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the | medium | 4.3 | =2.3.2 | – |
| CVE-2014-9031 | Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 a | medium | 4.3 | <=3.7.4 or =3.8 or =3.8.1 or =3.8.2 or =3.8.3 or =3.8.4 or =3.9 or =3.9.1 or =3.9.2 | – |
| CVE-2015-5733 | Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4 | medium | 4.3 | <=4.2.3 | – |
| CVE-2015-5622 | Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML | low | 3.5 | <=4.2.2 | – |
| CVE-2006-0733 | Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable at | low | 2.6 | =2.0 | – |
| CVE-2009-2853 | Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, | high | 10.0 | =0.71 or =0.72 or =0.711 or =1.0 or =1.0.1 or =1.2 or =1.2.1 or =1.2.2 or =1.5 or =1.5.1 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 | – |
| CVE-2014-6412 | WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach. | high | 8.1 | <4.4.0 | 4.4.0 |
| CVE-2008-6767 | wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cause a denial of servic | high | 10.0 | =2.6 | – |
| CVE-2019-20041 | wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass | critical | 9.8 | <5.3.1 | 5.3.1 |
| CVE-2019-17670 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation | critical | 9.8 | <5.2.4 | 5.2.4 |
| CVE-2016-2221 | Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attack | high | 7.4 | <=4.4.1 | – |
| CVE-2007-5105 | Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 and 2.0.1 allows remote attackers to inject arbitrary web scrip | medium | 4.3 | =2.0 or =2.0.1 | – |
| CVE-2023-5561 | WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the em | medium | 5.3 | >=4.7 and <4.7.27 or >=4.8 and <4.8.23 or >=4.9 and <4.9.24 or >=5.0 and <5.0.20 or >=5.1 and <5.1.17 or >=5.2 and <5.2.19 or >=5.3 and <5.3.16 or >=5.4 and <5.4.14 or >=5.5 and <5.5.13 or >=5.6 and <5.6.12 or >=5.7 and <5.7.10 or >=5.8 and <5.8.8 or >=5.9 and <5.9.8 or >=6.0 and <6.0.6 or >=6.1 and <6.1.4 or >=6.2 and <6.2.3 or >=6.3 and <6.3.2 | 4.7.27, 4.8.23, 4.9.24, 5.0.20 |
| CVE-2008-2392 | Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute | high | 9.0 | <=2.5.1 | – |
| CVE-2020-28035 | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. | critical | 9.8 | <5.5.2 | 5.5.2 |
| CVE-2018-10102 | Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag. | medium | 6.1 | <4.9.5 | 4.9.5 |
| CVE-2018-20150 | In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins. | medium | 6.1 | <4.9.9 or >=5.0 and <5.0.1 | 4.9.9, 5.0.1 |
| CVE-2016-5836 | The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors. | high | 7.5 | <=4.5.2 | – |
| CVE-2020-28039 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine wh | critical | 9.1 | <5.5.2 | 5.5.2 |
| CVE-2017-9065 | In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API. | high | 7.5 | <=4.7.4 | – |
| CVE-2008-0193 | Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remot | medium | 4.3 | <=2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.1.3_rc1 or =2.1.3_rc2 or =2.2 or =2.2.0 or =2.2.1 or =2.2.2 or =2.2.3 or =2.2_revision5002 or =2.2_revision5003 or =2.3 | – |
| CVE-2016-4029 | WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote at | high | 8.6 | <4.5 | 4.5 |
| CVE-2008-3233 | Cross-site scripting (XSS) vulnerability in WordPress before 2.6, SVN development versions only, allows remote attackers to inject arbitrary | medium | 4.3 | <=2.5.1 or =0.6.2 or =0.6.2.1 or =0.7 or =0.71 or =0.711 or =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.2.1 or =1.2.2 or =1.3.1 or =1.4 or =1.5 or =1.5-strayhorn or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.10_rc1 or =2.0.10_rc2 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.1.3_rc1 or =2.1.3_rc2 or =2.2 or =2.2.0 or =2.2.1 or =2.2.2 or =2.2.3 or =2.2_revision5002 or =2.2_revision5003 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 | – |
| CVE-2014-9038 | wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cond | medium | 6.4 | <=3.7.4 or =3.8 or =3.8.1 or =3.8.2 or =3.8.3 or =3.8.4 or =3.9 or =3.9.1 or =3.9.2 or =4.0 | – |
| CVE-2014-5203 | wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to exec | high | 7.5 | =3.9.0 or =3.9.1 | – |
| CVE-2013-7233 | Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlie | medium | 6.8 | <=2.0.11 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 | – |
| CVE-2017-1000600 | WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. Th | high | 8.8 | <4.9 | 4.9 |
| CVE-2016-5835 | WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, re | high | 7.5 | <=4.5.2 | – |
| CVE-2022-21664 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanit | high | 7.4 | <5.8.3 | 5.8.3 |
| CVE-2006-4028 | Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and remote attack vectors. NOTE: due to lack of details, | high | 10.0 | =2.0 or =2.0.1 or =2.0.2 or =2.0.3 | – |
| CVE-2008-0194 | Directory traversal vulnerability in wp-db-backup.php in WordPress 2.0.3 and earlier allows remote attackers to read arbitrary files, delete | high | 7.5 | <=2.0.3 | – |
| CVE-2022-21663 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with | medium | 6.6 | <5.8.3 | 5.8.3 |
| CVE-2017-9066 | In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF. | high | 8.6 | <=4.7.4 | – |
| CVE-2007-4894 | Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execu | high | 7.5 | =0.6.2 or =0.6.2.1 or =0.7 or =0.71 or =1.2 or =1.2.1 or =1.2.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.10_rc1 or =2.0.10_rc2 or =2.1.1 or =2.1.2 or =2.1.3 or =2.1.3_rc1 or =2.1.3_rc2 or =2.2 or =2.2.1 or =2.2.2 or =2.2_revision5002 or =2.2_revision5003 | – |
| CVE-2018-20152 | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input. | medium | 6.5 | <4.9.9 or >=5.0 and <5.0.1 | 4.9.9, 5.0.1 |
| CVE-2007-0539 | The wp_remote_fopen function in WordPress before 2.1 allows remote attackers to cause a denial of service (bandwidth or thread consumption) | high | 7.8 | <=2.0 | – |
| CVE-2006-5705 | Multiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0.5 allow remote authenticated users to read | medium | 6.0 | <=2.0.4 or =2.0.2 or =2.0.3 | – |
| CVE-2008-0664 | The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of ot | medium | 6.4 | =0.7 or =0.71 or =1.2 or =1.2.1 or =1.2.2 or =1.3.1 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.10 or =2.0.10_rc1 or =2.0.10_rc2 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.1.3_rc1 or =2.1.3_rc2 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.2_revision5002 or =2.2_revision5003 or =2.3 or =2.3.1 or =2.3.2 | – |
| CVE-2012-0782 | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlie | medium | 4.3 | <=3.3.1 or =0.7 or =0.71 or =0.72 or =0.711 or =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.2.1 or =1.2.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.6 or =2.9 or =2.9.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2.1 or =3.3 | – |
| CVE-2019-17673 | WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header. | high | 7.5 | <5.2.4 | 5.2.4 |
| CVE-2017-17092 | wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might all | medium | 5.4 | <4.9.1 | 4.9.1 |
| CVE-2010-4536 | Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary w | medium | 4.3 | <=3.0.3 | – |
| CVE-2022-3590 | WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation ch | medium | 5.9 | >=4.2 and <=6.1.1 or =4.1 | – |
| CVE-2008-0196 | Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a .. (dot do | medium | 5.0 | <=2.0.11 | – |
| CVE-2012-2401 | Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the | medium | 5.0 | <=3.3.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.3 | – |
| CVE-2013-2173 | wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to cause a denial of service | medium | 4.3 | =3.5.1 | – |
| CVE-2015-5731 | Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authent | medium | 6.8 | <=4.2.3 | – |
| CVE-2008-0195 | WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP | medium | 5.0 | <=2.0.11 | – |
| CVE-2005-4463 | WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to (1) wp-includes/vars.php, (2) wp-cont | medium | 5.0 | =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =2.0.1 | – |
| CVE-2006-0986 | WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) default-filters.php, (2) tem | medium | 5.0 | =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =2.0 or =2.0.1 | – |
| CVE-2007-6013 | Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication | critical | 9.8 | >=1.5 and <=2.3.1 | – |
| CVE-2012-1936 | The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a | medium | 6.8 | <=3.3.1 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 | – |
| CVE-2020-4047 | In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media | medium | 6.8 | >=3.7 and <3.7.34 or >=3.8 and <3.8.34 or >=3.9 and <3.9.32 or >=4.0 and <4.0.31 or >=4.1 and <4.1.31 or >=4.2 and <4.2.28 or >=4.3 and <4.3.24 or >=4.4 and <4.4.23 or >=4.5 and <4.5.22 or >=4.6 and <4.6.19 or >=4.7 and <4.7.18 or >=4.8 and <4.8.14 or >=4.9 and <4.9.15 or >=5.0 and <5.0.10 or >=5.1 and <5.1.6 or >=5.2 and <5.2.7 or >=5.3.0 and <5.3.4 or >=5.4 and <5.4.2 | 3.7.34, 3.8.34, 3.9.32, 4.0.31 |
| CVE-2007-0109 | wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obta | medium | 5.0 | =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 | – |
| CVE-2016-7169 | Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade packa | medium | 6.3 | <=4.6 | – |
| CVE-2008-5278 | Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before | medium | 4.3 | <=2.6.3 or =0.6.2 or =0.6.2.1 or =0.7 or =0.71 or =0.71-gold or =0.72 or =0.711 or =1.0 or =1.0-platinum or =1.0.1 or =1.0.1-miles or =1.0.2 or =1.0.2-blakey or =1.2 or =1.2-delta or =1.2-mingus or =1.2.1 or =1.2.2 or =1.3.1 or =1.4 or =1.5 or =1.5-strayhorn or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.10_rc1 or =2.0.10_rc2 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.1.3_rc1 or =2.1.3_rc2 or =2.2 or =2.2.0 or =2.2.1 or =2.2.2 or =2.2.3 or =2.2_revision5002 or =2.2_revision5003 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 | – |
| CVE-2017-5491 | wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with th | medium | 5.3 | <=4.7 | – |
| CVE-2011-0701 | wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) p | medium | 4.0 | <=3.0.4 | – |
| CVE-2011-4957 | The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the | medium | 5.0 | <=3.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 | – |
| CVE-2005-1810 | SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands | high | 7.5 | =1.5.1 | – |
| CVE-2010-4257 | SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated u | medium | 6.0 | <=3.0.1 | – |
| CVE-2014-5265 | The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarat | medium | 5.0 | <=3.9.1 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 or =3.5.0 or =3.5.1 or =3.6 or =3.6.1 or =3.7 or =3.7.1 or =3.8 or =3.8.1 or =3.9.0 | – |
| CVE-2013-0237 | Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other prod | medium | 4.3 | <=3.5.0 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 | – |
| CVE-2018-20147 | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files. | medium | 6.5 | <4.9.9 or >=5.0 and <5.0.1 | 4.9.9, 5.0.1 |
| CVE-2012-3383 | The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not p | low | 2.6 | =3.4.0 | – |
| CVE-2006-0985 | Multiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of WordPress 2.0.1 and earlier allow remote attacker | medium | 4.3 | =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =2.0 or =2.0.1 | – |
| CVE-2007-3239 | Cross-site scripting (XSS) vulnerability in searchform.php in the AndyBlue theme before 20070607 for WordPress allows remote attackers to in | medium | 4.3 | =2.2 | – |
| CVE-2003-1599 | PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code vi | high | 7.5 | =0.70 | – |
| CVE-2009-2432 | WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, whic | medium | 5.0 | <=2.7.1 or =0.6.2 or =0.6.2.1 or =0.7 or =0.71 or =0.71-gold or =0.72 or =0.711 or =1.0 or =1.0-platinum or =1.0.1 or =1.0.1-miles or =1.0.2 or =1.0.2-blakey or =1.2 or =1.2-delta or =1.2-mingus or =1.2.1 or =1.2.2 or =1.3.1 or =1.4 or =1.5 or =1.5-strayhorn or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.10_rc1 or =2.0.10_rc2 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.1.3_rc1 or =2.1.3_rc2 or =2.2 or =2.2.0 or =2.2.1 or =2.2.2 or =2.2.3 or =2.2_revision5002 or =2.2_revision5003 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.3 or =2.6.5 | – |
| CVE-2017-6816 | In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality. | medium | 4.9 | <=4.7.2 | – |
| CVE-2012-2400 | Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors. | high | 10.0 | <=3.3.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.3 | – |
| CVE-2007-1894 | Cross-site scripting (XSS) vulnerability in wp-includes/general-template.php in WordPress before 20070309 allows remote attackers to inject | medium | 4.3 | =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.1 or =2.1.1 or =2.1.2 or =2.2_revision5002 | – |
| CVE-2007-0106 | Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary | medium | 6.8 | =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 | – |
| CVE-2017-6514 | WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a / | medium | 5.3 | =4.7.2 | – |
| CVE-2006-1012 | SQL injection vulnerability in WordPress 1.5.2, and possibly other versions before 2.0, allows remote attackers to execute arbitrary SQL com | high | 7.5 | =1.5.2 | – |
| CVE-2013-2205 | The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote atta | medium | 4.3 | <=3.5.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 or =3.5.0 | – |
| CVE-2006-3389 | index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged param | medium | 5.0 | =2.0.3 | – |
| CVE-2016-1564 | Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to in | medium | 6.1 | <=4.4.0 | – |
| CVE-2006-2702 | vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC_REMOTE_ADDR HTTP | medium | 5.0 | =2.0.2 | – |
| CVE-2013-2204 | moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider | medium | 4.3 | <=3.5.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 or =3.5.0 | – |
| CVE-2003-1598 | SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the | high | 7.5 | <=0.7 | – |
| CVE-2018-20149 | In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended | medium | 5.4 | <4.9.9 or >=5.0 and <5.0.1 | 4.9.9, 5.0.1 |
| CVE-2017-5493 | wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, whic | high | 7.5 | <=4.7 | – |
| CVE-2005-2110 | WordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via (1) a direct request to menu-header.php or a "1" v | medium | 5.0 | =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.5 or =1.5.1 or =1.5.1.2 | – |
| CVE-2017-5612 | Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7. | medium | 6.1 | <=4.7.1 | – |
| CVE-2009-2431 | WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by | medium | 5.0 | =2.7.1 | – |
| CVE-2017-6814 | In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) misha | medium | 5.4 | <=4.7.2 | – |
| CVE-2005-1102 | Multiple cross-site scripting (XSS) vulnerabilities in template-functions-post.php in WordPress 1.5 and earlier allow remote attackers to ex | medium | 6.8 | <=1.5 | – |
| CVE-2006-3390 | WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-a | medium | 5.0 | =2.0.3 | – |
| CVE-2016-5838 | WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie. | high | 7.5 | <=4.5.2 | – |
| CVE-2016-7168 | Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might | medium | 4.8 | <=4.6 | – |
| CVE-2014-9032 | Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows r | medium | 4.3 | =3.9 or =3.9.1 or =3.9.2 or =4.0 | – |
| CVE-2016-5832 | The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors. | high | 7.5 | <=4.5.2 | – |
| CVE-2017-6815 | In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. | medium | 6.1 | <=4.7.2 | – |
| CVE-2019-17675 | WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CS | high | 8.8 | <5.2.4 | 5.2.4 |
| CVE-2007-3240 | Cross-site scripting (XSS) vulnerability in 404.php in the Vistered-Little theme for WordPress allows remote attackers to inject arbitrary w | medium | 4.3 | =2.2 | – |
| CVE-2019-20042 | In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a | medium | 6.1 | >=3.7 and <5.3.1 | 5.3.1 |
| CVE-2012-2403 | wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote | medium | 4.3 | <=3.3.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.3 | – |
| CVE-2016-5837 | WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspec | high | 7.5 | <=4.5.2 | – |
| CVE-2024-31211 | WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution vi | medium | 5.5 | >=6.4.0 and <6.4.2 | 6.4.2 |
| CVE-2008-2146 | wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remot | high | 7.5 | <=2.2.2 or =0.6.2 or =0.6.2.1 or =0.7 or =0.71 or =0.711 or =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.2.1 or =1.2.2 or =1.3.1 or =1.4 or =1.5 or =1.5-strayhorn or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.10_rc1 or =2.0.10_rc2 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.1.3_rc1 or =2.1.3_rc2 or =2.2 or =2.2.0 or =2.2.1 or =2.2_revision5002 or =2.2_revision5003 | – |
| CVE-2012-5868 | WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote a | low | 2.6 | =3.4.2 | – |
| CVE-2017-14726 | Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. | medium | 6.1 | <=4.8.1 | – |
| CVE-2012-2404 | wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site | medium | 4.3 | <=3.3.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.3 | – |
| CVE-2007-0541 | WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback s | medium | 5.0 | <=2.0 | – |
| CVE-2011-0700 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web scrip | low | 3.5 | <=3.0.4 | – |
| CVE-2018-10101 | Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server. | medium | 6.1 | <4.9.5 | 4.9.5 |
| CVE-2018-10100 | Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS. | medium | 6.1 | <4.9.5 | 4.9.5 |
| CVE-2013-4340 | wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the A | low | 3.5 | <=3.6 | – |
| CVE-2020-28038 | WordPress before 5.5.2 allows stored XSS via post slugs. | medium | 6.1 | <5.5.2 | 5.5.2 |
| CVE-2014-9037 | WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an acc | medium | 6.8 | <=3.7.4 or =3.8 or =3.8.1 or =3.8.2 or =3.8.3 or =3.8.4 or =3.9 or =3.9.1 or =3.9.2 or =4.0 | – |
| CVE-2017-6818 | In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names. | medium | 6.1 | <=4.7.2 | – |
| CVE-2012-2402 | wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and de | medium | 5.5 | <=3.3.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.3 | – |
| CVE-2020-28033 | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. | high | 7.5 | <5.5.2 | 5.5.2 |
| CVE-2007-0262 | WordPress 2.0.6, and 2.1Alpha 3 (SVN:4662), does not properly verify that the m parameter value has the string data type, which allows remot | high | 7.8 | =2.0.6 or =2.1 | – |
| CVE-2005-2109 | wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the | medium | 5.0 | =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.5 or =1.5.1 or =1.5.1.2 | – |
| CVE-2008-0191 | WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the defaul | medium | 5.0 | =2.2 or =2.3 | – |
| CVE-2016-5839 | WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors. | high | 7.5 | <=4.5.2 | – |
| CVE-2011-3122 | Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media securi | high | 10.0 | =3.1 or =3.1.1 or =3.1.2 or =3.2 | – |
| CVE-2017-14724 | Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery. | medium | 6.1 | <=4.8.1 | – |
| CVE-2005-2107 | Multiple cross-site scripting (XSS) vulnerabilities in post.php in WordPress 1.5.1.2 and earlier allow remote attackers to inject arbitrary | medium | 4.3 | =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.5 or =1.5.1 or =1.5.1.2 | – |
| CVE-2008-3747 | The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force S | high | 7.5 | =0.6.2 or =0.6.2.1 or =0.7 or =0.71 or =0.72 or =0.711 or =1.0 or =1.0.1 or =1.2 or =1.2.1 or =1.2.2 or =1.5 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.5 or =2.5.1 or =2.6 | – |
| CVE-2019-16220 | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open r | medium | 6.1 | <5.2.3 | 5.2.3 |
| CVE-2011-3818 | WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the ins | medium | 5.0 | =2.9.2 or =3.0.4 | – |
| CVE-2010-5293 | wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote | medium | 5.8 | <=3.0.1 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 | – |
| CVE-2020-4049 | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript | low | 2.4 | >=3.7 and <3.7.34 or >=3.8 and <3.8.34 or >=3.9 and <3.9.32 or >=4.0 and <4.0.31 or >=4.1 and <4.1.31 or >=4.2 and <4.2.28 or >=4.3 and <4.3.24 or >=4.4 and <4.4.23 or >=4.5 and <4.5.22 or >=4.6 and <4.6.19 or >=4.7 and <4.7.18 or >=4.8 and <4.8.14 or >=4.9 and <4.9.15 or >=5.0 and <5.0.10 or >=5.1 and <5.1.6 or >=5.2 and <5.2.7 or >=5.3.0 and <5.3.4 or >=5.4 and <5.4.2 | 3.7.34, 3.8.34, 3.9.32, 4.0.31 |
| CVE-2006-4743 | WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for (1) 404.php, (2) akismet.php, | medium | 5.0 | =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 | – |
| CVE-2016-6634 | Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary we | medium | 6.1 | <=4.4.4 | – |
| CVE-2011-4956 | Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspec | medium | 4.3 | <=3.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 | – |
| CVE-2012-0287 | Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows rem | low | 2.6 | =3.3 | – |
| CVE-2013-0236 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML | medium | 4.3 | <=3.5.0 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 | – |
| CVE-2019-20043 | In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the r | medium | 4.3 | >=3.7 and <5.3.1 | 5.3.1 |
| CVE-2014-9039 | wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset p | medium | 4.3 | <=3.7.4 or =3.8 or =3.8.1 or =3.8.2 or =3.8.3 or =3.8.4 or =3.9 or =3.9.1 or =3.9.2 or =4.0 | – |
| CVE-2011-3128 | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain se | medium | 5.0 | =3.1 or =3.1.1 or =3.1.2 or =3.2 | – |
| CVE-2011-3125 | Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various secu | high | 10.0 | =3.1 or =3.1.1 or =3.1.2 or =3.2 | – |
| CVE-2017-5490 | Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7. | medium | 6.1 | <=4.7 | – |
| CVE-2014-0165 | WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related | medium | 4.0 | <=3.7.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 or =3.5.0 or =3.5.1 or =3.6 or =3.6.1 or =3.7 or =3.8 or =3.8.1 | – |
| CVE-2014-9035 | Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0 | medium | 4.3 | <=3.7.4 or =3.8 or =3.8.1 or =3.8.2 or =3.8.3 or =3.8.4 or =3.9 or =3.9.1 or =3.9.2 or =4.0 | – |
| CVE-2014-9036 | Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remo | medium | 4.3 | <=3.7.4 or =3.8 or =3.8.1 or =3.8.2 or =3.8.3 or =3.8.4 or =3.9 or =3.9.1 or =3.9.2 or =4.0 | – |
| CVE-2007-3639 | WordPress before 2.2.2 allows remote attackers to redirect visitors to other websites and potentially obtain sensitive information via (1) t | medium | 4.0 | <=2.2.1 | – |
| CVE-2007-4139 | Cross-site scripting (XSS) vulnerability in the Temporary Uploads editing functionality (wp-admin/includes/upload.php) in WordPress 2.2.1, a | medium | 4.3 | =2.2.1 | – |
| CVE-2013-5738 | The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability f | medium | 4.3 | <=3.6 | – |
| CVE-2006-6017 | WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote auth | medium | 6.5 | <=2.0.5 | – |
| CVE-2015-7989 | Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitr | medium | 5.4 | <=4.3.0 | – |
| CVE-2020-11028 | In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specif | medium | 5.8 | <5.4.1 | 5.4.1 |
| CVE-2005-1687 | SQL injection vulnerability in wp-trackback.php in Wordpress 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via t | high | 7.5 | =1.5 | – |
| CVE-2017-14990 | WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), | medium | 6.5 | =4.8.2 | – |
| CVE-2009-2854 | Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or addition | medium | 6.4 | <=2.8.2 | – |
| CVE-2013-2202 | WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity dec | medium | 4.3 | <=3.5.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 or =3.5.0 | – |
| CVE-2007-5106 | Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 allows remote attackers to inject arbitrary web script or HTML | medium | 4.3 | =2.0 | – |
| CVE-2011-3126 | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects. | medium | 5.0 | =3.1 or =3.1.1 or =3.1.2 or =3.2 | – |
| CVE-2010-5297 | WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once chang | low | 2.1 | <=3.0 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 | – |
| CVE-2019-16222 | WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site s | medium | 6.1 | <5.2.3 | 5.2.3 |
| CVE-2017-6819 | In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to | medium | 6.5 | <=4.7.2 | – |
| CVE-2014-5240 | Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote au | low | 2.1 | <=3.9.1 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 or =3.5.0 or =3.5.1 or =3.6 or =3.6.1 or =3.7 or =3.7.1 or =3.8 or =3.8.1 or =3.9.0 | – |
| CVE-2017-14725 | Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php. | medium | 5.4 | <=4.8.1 | – |
| CVE-2010-5106 | The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote au | medium | 6.5 | <=3.0.2 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 | – |
| CVE-2016-9263 | WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Fla | medium | 4.7 | <=4.8.2 | – |
| CVE-2008-2068 | Cross-site scripting (XSS) vulnerability in WordPress 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vec | medium | 4.3 | =2.5 | – |
| CVE-2020-11029 | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site | medium | 5.8 | >=3.7 and <3.7.33 or >=3.8 and <3.8.33 or >=3.9 and <3.9.31 or >=4.0 and <4.0.30 or >=4.1 and <4.1.30 or >=4.2 and <4.2.27 or >=4.3 and <4.3.23 or >=4.4 and <4.4.22 or >=4.5 and <4.5.21 or >=4.6 and <4.6.18 or >=4.7 and <4.7.17 or >=4.8 and <4.8.13 or >=4.9 and <4.9.14 or >=5.0 and <5.0.9 or >=5.1 and <5.1.5 or >=5.2 and <5.2.6 or >=5.3 and <5.3.3 or =5.4 | 3.7.33, 3.8.33, 3.9.31, 4.0.30 |
| CVE-2020-4046 | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inj | medium | 5.4 | >=3.7 and <3.7.34 or >=3.8 and <3.8.34 or >=3.9 and <3.9.32 or >=4.0 and <4.0.31 or >=4.1 and <4.1.31 or >=4.2 and <4.2.28 or >=4.3 and <4.3.24 or >=4.4 and <4.4.23 or >=4.5 and <4.5.22 or >=4.6 and <4.6.19 or >=4.7 and <4.7.18 or >=4.8 and <4.8.14 or >=4.9 and <4.9.15 or >=5.0 and <5.0.10 or >=5.1 and <5.1.6 or >=5.2 and <5.2.7 or >=5.3.0 and <5.3.4 or >=5.4 and <5.4.2 | 3.7.34, 3.8.34, 3.9.32, 4.0.31 |
| CVE-2016-5834 | Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 a | medium | 6.1 | <=4.5.2 | – |
| CVE-2017-14718 | Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. | medium | 6.1 | <=4.8.1 | – |
| CVE-2017-14721 | Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name. | medium | 6.1 | <=4.8.1 | – |
| CVE-2007-1230 | Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to i | medium | 5.8 | =2.1 | – |
| CVE-2013-2201 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML | medium | 4.3 | <=3.5.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 or =3.5.0 | – |
| CVE-2009-3891 | Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject ar | low | 3.5 | <=2.8.5 | – |
| CVE-2008-6762 | Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web | medium | 4.3 | =2.6 | – |
| CVE-2021-29450 | Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts a | medium | 6.5 | >=4.7 and <5.7.1 | 5.7.1 |
| CVE-2020-11026 | In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon | high | 8.7 | >=3.7 and <3.7.33 or >=3.8 and <3.8.33 or >=3.9 and <3.9.31 or >=4.0 and <4.0.30 or >=4.1 and <4.1.30 or >=4.2 and <4.2.27 or >=4.3 and <4.3.23 or >=4.4 and <4.4.22 or >=4.5 and <4.5.21 or >=4.6 and <4.6.18 or >=4.7 and <4.7.17 or >=4.8 and <4.8.13 or >=4.9 and <4.9.14 or >=5.0 and <5.0.9 or >=5.1 and <5.1.5 or >=5.2 and <5.2.6 or >=5.3 and <5.3.3 or =5.4 | 3.7.33, 3.8.33, 3.9.31, 4.0.30 |
| CVE-2017-14720 | Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. | medium | 6.1 | <=4.8.1 | – |
| CVE-2007-4153 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web scr | low | 2.1 | =2.2.1 | – |
| CVE-2012-6634 | wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachm | medium | 6.4 | <=3.3.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.1 | – |
| CVE-2016-5833 | Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before | medium | 6.1 | <=4.5.2 | – |
| CVE-2018-20153 | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causi | medium | 5.4 | <4.9.9 or >=5.0 and <5.0.1 | 4.9.9, 5.0.1 |
| CVE-2013-2199 | The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to | medium | 4.3 | <=3.5.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 or =3.5.0 | – |
| CVE-2007-1409 | WordPress allows remote attackers to obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the p | medium | 5.0 | =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.1 or =2.1.1 | – |
| CVE-2013-2203 | WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an inva | medium | 4.3 | <=3.5.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 or =3.5.0 | – |
| CVE-2018-5776 | WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement). | medium | 6.1 | <4.9.2 | 4.9.2 |
| CVE-2007-1599 | wp-login.php in WordPress allows remote attackers to redirect authenticated users to other websites and potentially obtain sensitive informa | medium | 6.5 | =2.1.2 | – |
| CVE-2011-3129 | The file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running "on hosts with dangerous security settings," | high | 9.3 | =3.1 or =3.1.1 or =3.1.2 or =3.2 | – |
| CVE-2017-9063 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization s | medium | 6.1 | <=4.7.4 | – |
| CVE-2007-3238 | Cross-site scripting (XSS) vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators t | medium | 6.0 | =2.2 | – |
| CVE-2017-17094 | wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to | medium | 5.4 | <4.9.1 | 4.9.1 |
| CVE-2006-1796 | Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly | medium | 6.8 | <=2.0 or =0.6.2 or =0.6.2.1 or =0.7 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.2 or =1.2.1 or =1.2.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 | – |
| CVE-2020-4048 | In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted | medium | 5.7 | >=3.7 and <3.7.34 or >=3.8 and <3.8.34 or >=3.9 and <3.9.32 or >=4.0 and <4.0.31 or >=4.1 and <4.1.31 or >=4.2 and <4.2.28 or >=4.3 and <4.3.24 or >=4.4 and <4.4.23 or >=4.5 and <4.5.22 or >=4.6 and <4.6.19 or >=4.7 and <4.7.18 or >=4.8 and <4.8.14 or >=4.9 and <4.9.15 or >=5.0 and <5.0.10 or >=5.1 and <5.1.6 or >=5.2 and <5.2.7 or >=5.3.0 and <5.3.4 or >=5.4 and <5.4.2 | 3.7.34, 3.8.34, 3.9.32, 4.0.31 |
| CVE-2017-17093 | wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might all | medium | 5.4 | <4.9.1 | 4.9.1 |
| CVE-2021-39200 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio | medium | 5.3 | >=5.2 and <5.8.1 | 5.8.1 |
| CVE-2017-6817 | In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds. | medium | 5.4 | <=4.7.2 | – |
| CVE-2014-9033 | Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack | medium | 6.8 | =3.7.4 or =3.8.4 or =3.9.2 or =4.0 | – |
| CVE-2017-9061 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error m | medium | 6.1 | <=4.7.4 | – |
| CVE-2017-5492 | Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote att | high | 8.8 | <=4.7 | – |
| CVE-2006-6016 | wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified | medium | 6.5 | <=2.0.4 | – |
| CVE-2020-25286 | In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments e | medium | 5.3 | <5.4.2 | 5.4.2 |
| CVE-2016-6635 | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPre | high | 8.8 | <=4.4.2 | – |
| CVE-2005-1688 | Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, ( | medium | 5.3 | <=1.5 | – |
| CVE-2012-3385 | WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or con | medium | 5.0 | <=3.4.0 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.2 or =3.3.3 | – |
| CVE-2012-4421 | The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows | medium | 4.0 | <=3.4.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 | – |
| CVE-2007-4154 | SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands v | medium | 6.5 | =2.2.1 | – |
| CVE-2019-16219 | WordPress before 5.2.3 allows XSS in shortcode previews. | medium | 6.1 | <5.2.3 | 5.2.3 |
| CVE-2014-5204 | wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the | medium | 6.8 | <=3.9.1 or =3.9.0 | – |
| CVE-2014-5205 | wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tok | medium | 6.8 | <=3.9.1 or =3.9.0 | – |
| CVE-2010-5295 | Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary | medium | 4.3 | <=3.0.1 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 | – |
| CVE-2019-16218 | WordPress before 5.2.3 allows XSS in stored comments. | medium | 6.1 | <5.2.3 | 5.2.3 |
| CVE-2015-8834 | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web | medium | 6.1 | <=4.2.1 | – |
| CVE-2007-3241 | Cross-site scripting (XSS) vulnerability in blogroll.php in the cordobo-green-park theme for WordPress allows remote attackers to inject arb | medium | 4.3 | =2.2 | – |
| CVE-2017-9062 | In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. | high | 8.6 | <=4.7.4 | – |
| CVE-2007-3544 | Unrestricted file upload vulnerability in (1) wp-app.php and (2) app.php in WordPress 2.2.1 and WordPress MU 1.2.3 allows remote authenticat | medium | 6.5 | <=2.2.0 | – |
| CVE-2019-16221 | WordPress before 5.2.3 allows reflected XSS in the dashboard. | medium | 6.1 | <5.2.3 | 5.2.3 |
| CVE-2019-17672 | WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements. | medium | 6.1 | <5.2.4 | 5.2.4 |
| CVE-2013-2200 | WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restric | medium | 4.0 | <=3.5.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =1.6.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 or =3.4.1 or =3.4.2 or =3.5.0 | – |
| CVE-2013-5739 | The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote a | low | 3.5 | <=3.6 | – |
| CVE-2012-6635 | wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remot | medium | 4.0 | <=3.3.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.1 | – |
| CVE-2017-5488 | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject a | medium | 6.1 | <=4.7 | – |
| CVE-2017-9064 | In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is | high | 8.8 | <=4.7.4 | – |
| CVE-2012-6633 | Cross-site scripting (XSS) vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbi | medium | 4.3 | <=3.3.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.1 | – |
| CVE-2023-22622 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the so | medium | 5.3 | <=6.1.1 | – |
| CVE-2020-28034 | WordPress before 5.5.2 allows XSS associated with global variables. | medium | 6.1 | <5.5.2 | 5.5.2 |
| CVE-2019-16780 | WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is | medium | 5.8 | >3.7 and <5.3.1 or =3.7 | 5.3.1 |
| CVE-2010-5296 | wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for th | medium | 4.9 | <=3.0.1 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 | – |
| CVE-2012-4422 | wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges b | low | 3.5 | <=3.4.1 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.1 or =3.3.2 or =3.3.3 or =3.4.0 | – |
| CVE-2006-1263 | Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web s | medium | 4.3 | =0.6.2 or =0.6.2.1 or =0.7 or =0.71 or =1.2 or =1.2.1 or =1.2.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 | – |
| CVE-2007-3543 | Unrestricted file upload vulnerability in WordPress before 2.2.1 and WordPress MU before 1.2.3 allows remote authenticated users to upload a | medium | 6.0 | <=2.2.0 | – |
| CVE-2016-10148 | The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checkin | medium | 4.3 | <=4.5.5 | – |
| CVE-2019-16781 | In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, whi | medium | 5.8 | <5.3.1 | 5.3.1 |
| CVE-2011-3130 | wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy quer | high | 7.5 | =3.1 or =3.1.1 or =3.1.2 or =3.2 | – |
| CVE-2019-17674 | WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer. | medium | 5.4 | <5.2.4 | 5.2.4 |
| CVE-2007-1732 | Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators | low | 3.5 | =2.1.2 | – |
| CVE-2019-16217 | WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. | medium | 6.1 | <5.2.3 | 5.2.3 |
| CVE-2020-11025 | In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code | medium | 5.8 | >=4.7 and <5.4.1 | 5.4.1 |
| CVE-2011-3127 | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party | medium | 5.8 | =3.1 or =3.1.1 or =3.1.2 or =3.2 | – |
| CVE-2007-4893 | wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_h | medium | 4.3 | =0.6.2 or =0.6.2.1 or =0.7 or =0.71 or =1.2 or =1.2.1 or =1.2.2 or =1.5 or =1.5.1 or =1.5.1.2 or =1.5.1.3 or =2.0 or =2.0.1 or =2.0.2 or =2.0.3 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.10_rc1 or =2.0.10_rc2 or =2.1.1 or =2.1.2 or =2.1.3 or =2.1.3_rc1 or =2.1.3_rc2 or =2.2 or =2.2.1 or =2.2.2 or =2.2_revision5002 or =2.2_revision5003 | – |
| CVE-2022-43504 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email addr | medium | 5.3 | <3.7.40 or >=3.8 and <3.8.40 or >=3.9 and <3.9.39 or >=4.0 and <4.0.37 or >=4.1 and <4.1.37 or >=4.2 and <4.2.34 or >=4.3 and <4.3.30 or >=4.4 and <4.4.29 or >=4.5 and <4.5.28 or >=4.6 and <4.6.25 or >=4.7 and <4.7.25 or >=4.8 and <4.8.21 or >=4.9 and <4.9.22 or >=5.0 and <5.0.18 or >=5.1 and <5.1.15 or >=5.2 and <5.2.17 or >=5.3 and <5.3.14 or >=5.4 and <5.4.12 or >=5.5 and <5.5.11 or >=5.6 and <5.6.10 or >=5.7 and <5.7.8 or >=5.8 and <5.8.6 or >=5.9 and <5.9.5 or >=6.0 and <6.0.3 | 3.7.40, 3.8.40, 3.9.39, 4.0.37 |
| CVE-2021-39201 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The iss | high | 7.6 | >=5.0 and <5.8 | 5.8 |
| CVE-2011-5270 | wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticat | medium | 4.0 | <=3.0.5 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 | – |
| CVE-2020-11030 | In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the | medium | 6.4 | <5.4.1 | 5.4.1 |
| CVE-2020-4050 | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It | low | 3.5 | >=3.7 and <3.7.34 or >=3.8 and <3.8.34 or >=3.9 and <3.9.32 or >=4.0 and <4.0.31 or >=4.1 and <4.1.31 or >=4.2 and <4.2.28 or >=4.3 and <4.3.24 or >=4.4 and <4.4.23 or >=4.5 and <4.5.22 or >=4.6 and <4.6.19 or >=4.7 and <4.7.18 or >=4.8 and <4.8.14 or >=4.9 and <4.9.15 or >=5.0 and <5.0.10 or >=5.1 and <5.1.6 or >=5.2 and <5.2.7 or >=5.3.0 and <5.3.4 or >=5.4 and <5.4.2 | 3.7.34, 3.8.34, 3.9.32, 4.0.31 |
| CVE-2010-5294 | Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPres | medium | 4.3 | <=3.0.1 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 | – |
| CVE-2017-5489 | Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecifie | high | 8.8 | <=4.7 | – |
| CVE-2008-5113 | WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to condu | medium | 4.0 | =2.6.3 | – |
| CVE-2022-43497 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scri | medium | 6.1 | <3.7.40 or >=3.8 and <3.8.40 or >=3.9 and <3.9.39 or >=4.0 and <4.0.37 or >=4.1 and <4.1.37 or >=4.2 and <4.2.34 or >=4.3 and <4.3.30 or >=4.4 and <4.4.29 or >=4.5 and <4.5.28 or >=4.6 and <4.6.25 or >=4.7 and <4.7.25 or >=4.8 and <4.8.21 or >=4.9 and <4.9.22 or >=5.0 and <5.0.18 or >=5.1 and <5.1.15 or >=5.2 and <5.2.17 or >=5.3 and <5.3.14 or >=5.4 and <5.4.12 or >=5.5 and <5.5.11 or >=5.6 and <5.6.10 or >=5.7 and <5.7.8 or >=5.8 and <5.8.6 or >=5.9 and <5.9.5 or >=6.0 and <6.0.3 | 3.7.40, 3.8.40, 3.9.39, 4.0.37 |
| CVE-2012-3384 | Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentica | medium | 6.8 | <=3.4.0 or =0.71 or =1.0 or =1.0.1 or =1.0.2 or =1.1.1 or =1.2 or =1.2.1 or =1.2.2 or =1.2.3 or =1.2.4 or =1.2.5 or =1.3 or =1.3.2 or =1.3.3 or =1.5 or =1.5.1 or =1.5.1.1 or =1.5.1.2 or =1.5.1.3 or =1.5.2 or =2.0 or =2.0.1 or =2.0.2 or =2.0.4 or =2.0.5 or =2.0.6 or =2.0.7 or =2.0.8 or =2.0.9 or =2.0.10 or =2.0.11 or =2.1 or =2.1.1 or =2.1.2 or =2.1.3 or =2.2 or =2.2.1 or =2.2.2 or =2.2.3 or =2.3 or =2.3.1 or =2.3.2 or =2.3.3 or =2.5 or =2.5.1 or =2.6 or =2.6.1 or =2.6.2 or =2.6.3 or =2.6.5 or =2.7 or =2.7.1 or =2.8 or =2.8.1 or =2.8.2 or =2.8.3 or =2.8.4 or =2.8.5 or =2.8.5.1 or =2.8.5.2 or =2.8.6 or =2.9 or =2.9.1 or =2.9.1.1 or =2.9.2 or =3.0 or =3.0.1 or =3.0.2 or =3.0.3 or =3.0.4 or =3.0.5 or =3.0.6 or =3.1 or =3.1.1 or =3.1.2 or =3.1.3 or =3.1.4 or =3.2 or =3.2.1 or =3.3 or =3.3.2 or =3.3.3 | – |
| CVE-2023-39999 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1 | medium | 4.3 | >=4.1 and <=4.1.38 or >=4.2 and <=4.2.35 or >=4.3 and <=4.3.31 or >=4.4 and <=4.4.30 or >=4.5 and <=4.5.29 or >=4.6 and <=4.6.26 or >=4.7 and <=4.7.26 or >=4.8 and <=4.8.22 or >=4.9 and <=4.9.23 or >=5.0 and <=5.0.19 or >=5.1 and <=5.1.16 or >=5.2 and <=5.2.18 or >=5.3 and <=5.3.15 or >=5.4 and <=5.4.13 or >=5.5 and <=5.5.12 or >=5.6 and <=5.6.11 or >=5.7 and <=5.7.9 or >=5.8 and <=5.8.7 or >=5.9 and <=5.9.7 or >=6.0 and <=6.0.5 or >=6.1 and <=6.1.3 or >=6.2 and <=6.2.2 or >=6.3 and <6.3.2 | 6.3.2 |
| CVE-2007-1893 | xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended | medium | 4.9 | <=2.1.2 | – |
| CVE-2012-4448 | Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authenticatio | medium | 6.8 | =3.4.2 | – |
| CVE-2012-6707 | WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values | high | 7.5 | <=4.8.2 | – |
| CVE-2020-28040 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. | medium | 4.3 | <5.5.2 | 5.5.2 |
| CVE-2024-31210 | WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plug | high | 7.6 | <4.1.40 or >=4.2 and <4.2.37 or >=4.3 and <4.3.33 or >=4.4 and <4.4.32 or >=4.5 and <4.5.31 or >=4.6 and <4.6.28 or >=4.7 and <4.7.28 or >=4.8 and <4.8.24 or >=4.9 and <4.9.25 or >=5.0 and <5.0.21 or >=5.1 and <5.1.18 or >=5.2 and <5.2.20 or >=5.3 and <5.3.17 or >=5.4 and <5.4.15 or >=5.5 and <5.5.14 or >=5.6 and <5.6.13 or >=5.7 and <5.7.11 or >=5.8 and <5.8.9 or >=5.9 and <5.9.9 or >=6.0 and <6.0.7 or >=6.1 and <6.1.5 or >=6.2 and <6.2.4 or >=6.3 and <6.3.3 or >=6.4.0 and <6.4.3 | 4.1.40, 4.2.37, 4.3.33, 4.4.32 |
| CVE-2022-43500 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scri | medium | 6.1 | <3.7.40 or >=3.8 and <3.8.40 or >=3.9 and <3.9.39 or >=4.0 and <4.0.37 or >=4.1 and <4.1.37 or >=4.2 and <4.2.34 or >=4.3 and <4.3.30 or >=4.4 and <4.4.29 or >=4.5 and <4.5.28 or >=4.6 and <4.6.25 or >=4.7 and <4.7.25 or >=4.8 and <4.8.21 or >=4.9 and <4.9.22 or >=5.0 and <5.0.18 or >=5.1 and <5.1.15 or >=5.2 and <5.2.17 or >=5.3 and <5.3.14 or >=5.4 and <5.4.12 or >=5.5 and <5.5.11 or >=5.6 and <5.6.10 or >=5.7 and <5.7.8 or >=5.8 and <5.8.6 or >=5.9 and <5.9.5 or >=6.0 and <6.0.3 | 3.7.40, 3.8.40, 3.9.39, 4.0.37 |
| CVE-2021-39203 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio | medium | 6.8 | =5.8 | – |
| CVE-2023-38000 | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 t | medium | 6.5 | >=5.9 and <=5.9.7 or >=6.0 and <=6.0.5 or >=6.1 and <=6.1.3 or >=6.2 and <=6.2.2 or >=6.3 and <=6.3.1 | – |
| CVE-2021-39202 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio | high | 7.6 | =5.8 | – |
| CVE-2011-1762 | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This | medium | 6.5 | <3.0.6 or >=3.1 and <3.1.2 | 3.0.6, 3.1.2 |
| CVE-2022-4973 | WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with acce | medium | 4.9 | <=6.0.2 | – |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked