WO
CMS
WordPress
On CISA KEVExploited in the wild
364
CVEs
7
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 20High 47Medium 102Low 2
Watch
Add WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-17673 | 7.5 | Oct 17 | WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header Affected: before 5.2.4 |
| CVE-2018-20151 | 7.5 | Dec 14 | In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen Affected: before 4.9.9; 5.0 before 5.0.1 |
| CVE-2018-6389 | 7.5 | Feb 6 | In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from… Affected: through 4.9.2 |
| CVE-2012-6707 | 7.5 | Oct 19 | WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values Affected: through 4.8.2 |
| CVE-2017-14722 | 7.5 | Sep 23 | Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename Affected: 4.7; 4.7.1; 4.7.2; 4.7.3; 4.7.4; 4.7.5; +2 more |
| CVE-2017-14719 | 7.5 | Sep 23 | Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components Affected: 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +34 more |
| CVE-2017-9065 | 7.5 | May 18 | In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API Affected: through 4.7.4 |
| CVE-2017-1001000 | 7.5 | Apr 3 | The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer… Affected: 4.7; 4.7.1; 4.7.2 |
| CVE-2017-5493 | 7.5 | Jan 15 | wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers… Affected: through 4.7 |
| CVE-2016-5839 | 7.5 | Jun 29 | WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors Affected: through 4.5.2 |
| CVE-2016-5838 | 7.5 | Jun 29 | WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie Affected: through 4.5.2 |
| CVE-2016-5837 | 7.5 | Jun 29 | WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors Affected: through 4.5.2 |
| CVE-2016-5836 | 7.5 | Jun 29 | The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors Affected: through 4.5.2 |
| CVE-2016-5835 | 7.5 | Jun 29 | WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to… Affected: through 4.5.2 |
| CVE-2016-5832 | 7.5 | Jun 29 | The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors Affected: through 4.5.2 |
| CVE-2016-2221 | 7.4 | May 22 | Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web… Affected: through 4.4.1 |
| CVE-2022-21663 | 7.2 | Jan 6 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database Affected: before 5.8.3 |
| CVE-2018-14028 | 7.2 | Aug 10 | In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files Affected: 4.9.7 |
| CVE-2016-6896 | 7.1 | Jan 18 | Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a… Affected: 4.5.3 |
| CVE-2020-4047 | 6.8 | Jun 12 | In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way Affected: 3.7 before 3.7.34; 3.8 before 3.8.34; 3.9 before 3.9.32; 4.0 before 4.0.31; 4.1 before 4.1.31; 4.2 before 4.2.28; +12 more |
| CVE-2011-1762 | 6.5 | Apr 18 | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts Affected: before 3.0.6; 3.1 before 3.1.2 |
| CVE-2021-39203 | 6.5 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database Affected: 5.8 |
| CVE-2021-29447 | 6.5 | Apr 15 | Wordpress is an open source CMS Affected: 5.6.0 before 5.7.1 |
| CVE-2019-8943 | 6.5 | Feb 20 | WordPress through 5.0.3 allows Path Traversal in wp_crop_image() Affected: through 5.0.3 |
| CVE-2018-20152 | 6.5 | Dec 14 | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input Affected: before 4.9.9; 5.0 before 5.0.1 |
| CVE-2018-20147 | 6.5 | Dec 14 | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files Affected: before 4.9.9; 5.0 before 5.0.1 |
| CVE-2017-14990 | 6.5 | Oct 3 | WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote… Affected: 4.8.2 |
| CVE-2017-6819 | 6.5 | Mar 12 | In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources Affected: through 4.7.2 |
| CVE-2016-6897 | 6.5 | Jan 18 | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to… Affected: through 4.5.5 |
| CVE-2006-6016 | 6.5 | Nov 21 | wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified user_id parameter Affected: through 2.0.4 |
| CVE-2006-6017 | 6.5 | Nov 21 | WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of… Affected: through 2.0.5 |
| CVE-2020-37233 | 6.4 | May 16 | WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting Affected: 6.2.0 |
| CVE-2016-7169 | 6.3 | Jan 5 | Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1… Affected: through 4.6 |
| CVE-2024-4439 | 6.1 | May 3 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the… Affected: 6.0 through 6.0.7; 6.1 through 6.1.5; 6.2 through 6.2.4; 6.3 through 6.3.3; 6.4.0 through 6.4.3; 6.5 through 6.5.1 |
| CVE-2022-43500 | 6.1 | Dec 5 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script Affected: before 3.7.40; 3.8 before 3.8.40; 3.9 before 3.9.39; 4.0 before 4.0.37; 4.1 before 4.1.37; 4.2 before 4.2.34; +18 more |
| CVE-2022-43497 | 6.1 | Dec 5 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script Affected: before 3.7.40; 3.8 before 3.8.40; 3.9 before 3.9.39; 4.0 before 4.0.37; 4.1 before 4.1.37; 4.2 before 4.2.34; +18 more |
| CVE-2020-28038 | 6.1 | Nov 2 | WordPress before 5.5.2 allows stored XSS via post slugs Affected: before 5.5.2 |
| CVE-2020-28034 | 6.1 | Nov 2 | WordPress before 5.5.2 allows XSS associated with global variables Affected: before 5.5.2 |
| CVE-2020-11029 | 6.1 | Apr 30 | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks Affected: 3.7 before 3.7.33; 3.8 before 3.8.33; 3.9 before 3.9.31; 4.0 before 4.0.30; 4.1 before 4.1.30; 4.2 before 4.2.27; +12 more |
| CVE-2019-20042 | 6.1 | Dec 27 | In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS)… Affected: 3.7 before 5.3.1 |
| CVE-2019-17672 | 6.1 | Oct 17 | WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements Affected: before 5.2.4 |
| CVE-2019-16222 | 6.1 | Sep 11 | WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks Affected: before 5.2.3 |
| CVE-2019-16221 | 6.1 | Sep 11 | WordPress before 5.2.3 allows reflected XSS in the dashboard Affected: before 5.2.3 |
| CVE-2019-16220 | 6.1 | Sep 11 | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not… Affected: before 5.2.3 |
| CVE-2019-16219 | 6.1 | Sep 11 | WordPress before 5.2.3 allows XSS in shortcode previews Affected: before 5.2.3 |
| CVE-2019-16218 | 6.1 | Sep 11 | WordPress before 5.2.3 allows XSS in stored comments Affected: before 5.2.3 |
| CVE-2019-16217 | 6.1 | Sep 11 | WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled Affected: before 5.2.3 |
| CVE-2018-20150 | 6.1 | Dec 14 | In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins Affected: before 4.9.9; 5.0 before 5.0.1 |
| CVE-2018-10102 | 6.1 | Apr 16 | Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag Affected: before 4.9.5 |
| CVE-2018-10101 | 6.1 | Apr 16 | Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server Affected: before 4.9.5 |