WO
CMS
WordPress
On CISA KEVExploited in the wild
365
CVEs
7
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 20High 47Medium 103Low 2
Watch
Add WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-10100 | 6.1 | Apr 16 | Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS Affected: before 4.9.5 |
| CVE-2018-5776 | 6.1 | Jan 18 | WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement) Affected: before 4.9.2 |
| CVE-2017-14726 | 6.1 | Sep 23 | Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor Affected: through 4.8.1 |
| CVE-2017-14724 | 6.1 | Sep 23 | Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery Affected: through 4.8.1 |
| CVE-2017-14721 | 6.1 | Sep 23 | Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name Affected: through 4.8.1 |
| CVE-2017-14720 | 6.1 | Sep 23 | Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name Affected: through 4.8.1 |
| CVE-2017-14718 | 6.1 | Sep 23 | Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL Affected: through 4.8.1 |
| CVE-2017-9063 | 6.1 | May 18 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session Affected: through 4.7.4 |
| CVE-2017-9061 | 6.1 | May 18 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict… Affected: through 4.7.4 |
| CVE-2017-6818 | 6.1 | Mar 12 | In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names Affected: through 4.7.2 |
| CVE-2017-6815 | 6.1 | Mar 12 | In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation Affected: through 4.7.2 |
| CVE-2017-5612 | 6.1 | Jan 30 | Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject… Affected: through 4.7.1 |
| CVE-2017-5490 | 6.1 | Jan 15 | Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject… Affected: through 4.7 |
| CVE-2017-5488 | 6.1 | Jan 15 | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1)… Affected: through 4.7 |
| CVE-2016-6634 | 6.1 | Aug 7 | Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: through 4.4.4 |
| CVE-2016-5834 | 6.1 | Jun 29 | Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject… Affected: through 4.5.2 |
| CVE-2016-5833 | 6.1 | Jun 29 | Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to… Affected: through 4.5.2 |
| CVE-2016-4567 | 6.1 | May 22 | Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject… Affected: through 4.5.1 |
| CVE-2016-4566 | 6.1 | May 22 | Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script… Affected: through 4.5.1 |
| CVE-2016-1564 | 6.1 | May 22 | Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a… Affected: through 4.4.0 |
| CVE-2015-8834 | 6.1 | May 22 | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that… Affected: through 4.2.1 |
| CVE-2015-5714 | 6.1 | May 22 | Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML… Affected: through 4.3.0 |
| CVE-2022-3590 | 5.9 | Dec 14 | WordPress is affected by an unauthenticated blind SSRF in the pingback feature Affected: 4.2 through 6.1.1; 4.1 |
| CVE-2017-8295 | 5.9 | May 4 | WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a… Affected: through 4.7.4 |
| CVE-2020-4048 | 5.7 | Jun 12 | In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect… Affected: 3.7 before 3.7.34; 3.8 before 3.8.34; 3.9 before 3.9.32; 4.0 before 4.0.31; 4.1 before 4.1.31; 4.2 before 4.2.28; +12 more |
| CVE-2022-4973 | 5.4 | Oct 16 | WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page… Affected: through 6.0.2 |
| CVE-2023-38000 | 5.4 | Oct 13 | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5,… Affected: 5.9 through 5.9.7; 6.0 through 6.0.5; 6.1 through 6.1.3; 6.2 through 6.2.2; 6.3 through 6.3.1 |
| CVE-2023-2745 | 5.4 | May 17 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter Affected: before 4.1.38; 4.2 before 4.2.35; 4.3 before 4.3.31; 4.4 before 4.4.30; 4.5 before 4.5.29; 4.6 before 4.6.26; +16 more |
| CVE-2022-21662 | 5.4 | Jan 6 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database Affected: before 5.8.3 |
| CVE-2021-39202 | 5.4 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database Affected: 5.8; 5.8 |
| CVE-2021-39201 | 5.4 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database Affected: 5.0 before 5.8 |
| CVE-2020-4046 | 5.4 | Jun 12 | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor Affected: 3.7 before 3.7.34; 3.8 before 3.8.34; 3.9 before 3.9.32; 4.0 before 4.0.31; 4.1 before 4.1.31; 4.2 before 4.2.28; +12 more |
| CVE-2020-11030 | 5.4 | Apr 30 | In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor Affected: before 5.4.1 |
| CVE-2020-11026 | 5.4 | Apr 30 | In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file Affected: 3.7 before 3.7.33; 3.8 before 3.8.33; 3.9 before 3.9.31; 4.0 before 4.0.30; 4.1 before 4.1.30; 4.2 before 4.2.27; +12 more |
| CVE-2020-11025 | 5.4 | Apr 30 | In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed Affected: 4.7 before 5.4.1 |
| CVE-2019-16781 | 5.4 | Dec 26 | In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard Affected: before 5.3.1 |
| CVE-2019-16780 | 5.4 | Dec 26 | WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard Affected: after 3.7 before 5.3.1; 3.7 |
| CVE-2019-17674 | 5.4 | Oct 17 | WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer Affected: before 5.2.4 |
| CVE-2019-16223 | 5.4 | Sep 11 | WordPress before 5.2.3 allows XSS in post previews by authenticated users Affected: before 5.2.3 |
| CVE-2018-20153 | 5.4 | Dec 14 | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS Affected: before 4.9.9; 5.0 before 5.0.1 |
| CVE-2018-20149 | 5.4 | Dec 14 | In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to… Affected: before 4.9.9; 5.0 before 5.0.1 |
| CVE-2017-17094 | 5.4 | Dec 2 | wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL Affected: before 4.9.1 |
| CVE-2017-17093 | 5.4 | Dec 2 | wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via… Affected: before 4.9.1 |
| CVE-2017-17092 | 5.4 | Dec 2 | wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS… Affected: before 4.9.1 |
| CVE-2017-14725 | 5.4 | Sep 23 | Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php Affected: through 4.8.1 |
| CVE-2017-6817 | 5.4 | Mar 12 | In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds Affected: through 4.7.2 |
| CVE-2017-6814 | 5.4 | Mar 12 | In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata Affected: through 4.7.2 |
| CVE-2015-7989 | 5.4 | May 22 | Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted… Affected: through 4.3.0 |
| CVE-2023-5561 | 5.3 | Oct 16 | WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have… Affected: 4.7 before 4.7.27; 4.8 before 4.8.23; 4.9 before 4.9.24; 5.0 before 5.0.20; 5.1 before 5.1.17; 5.2 before 5.2.19; +11 more |
| CVE-2023-22622 | 5.3 | Jan 5 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where… Affected: through 6.1.1 |