WO
CMS
WordPress
On CISA KEVExploited in the wild
366
CVEs
7
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 20High 48Medium 103Low 2
Watch
Add WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-22622 | 5.3 | Jan 5 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where… Affected: through 6.1.1 |
| CVE-2022-43504 | 5.3 | Dec 5 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using… Affected: before 3.7.40; 3.8 before 3.8.40; 3.9 before 3.9.39; 4.0 before 4.0.37; 4.1 before 4.1.37; 4.2 before 4.2.34; +18 more |
| CVE-2021-39200 | 5.3 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database Affected: 5.2 before 5.8.1 |
| CVE-2020-25286 | 5.3 | Sep 13 | In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public Affected: before 5.4.2 |
| CVE-2019-17671 | 5.3 | Oct 17 | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled Affected: before 5.2.4 |
| CVE-2017-6514 | 5.3 | May 22 | WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request,… Affected: 4.7.2 |
| CVE-2017-5610 | 5.3 | Jan 30 | wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows… Affected: through 4.7.1 |
| CVE-2017-5491 | 5.3 | Jan 15 | wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name Affected: through 4.7 |
| CVE-2017-5487 | 5.3 | Jan 15 | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors,… Affected: through 4.7 |
| CVE-2005-1688 | 5.3 | May 20 | Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, (2) wp-includes/, or (3) wp-admin/,… Affected: through 1.5 |
| CVE-2026-114570 New | 4.9 | Oct 22 | WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit Affected: 4.7.0 through 4.7.33; 4.8.0 through 4.8.28; 4.9.0 through 4.9.29; 5.0.0 through 5.0.25; 5.1.0 through 5.1.22; 5.2.0 through 5.2.24; +18 more |
| CVE-2017-6816 | 4.9 | Mar 12 | In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality Affected: through 4.7.2 |
| CVE-2016-7168 | 4.8 | Jan 5 | Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject… Affected: through 4.6 |
| CVE-2016-9263 | 4.7 | Oct 12 | WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by… Affected: through 4.8.2 |
| CVE-2026-3906 | 4.3 | Mar 11 | WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API Affected: 6.9 through 6.9.1 |
| CVE-2023-39999 | 4.3 | Oct 13 | WordPress < 6.3.2 is vulnerable to Broken Access Control Affected: 6.3 through 6.3.1; 6.2 through 6.2.2; 6.1 through 6.1.3; 6.0 through 6.0.5; 5.9 through 5.9.7; 5.8 through 5.8.7; +17 more |
| CVE-2021-29450 | 4.3 | Apr 15 | Wordpress is an open source CMS Affected: 4.7 before 5.7.1 |
| CVE-2020-28040 | 4.3 | Nov 2 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image Affected: before 5.5.2 |
| CVE-2019-20043 | 4.3 | Dec 27 | In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to… Affected: 3.7 before 5.3.1 |
| CVE-2016-10148 | 4.3 | Jan 18 | The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which… Affected: through 4.5.5 |
| CVE-2015-5715 | 4.3 | May 22 | The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access… Affected: through 4.3.0 |
| CVE-2020-4050 | 3.1 | Jun 12 | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved Affected: 3.7 before 3.7.34; 3.8 before 3.8.34; 3.9 before 3.9.32; 4.0 before 4.0.31; 4.1 before 4.1.31; 4.2 before 4.2.28; +12 more |
| CVE-2020-4049 | 2.4 | Jun 12 | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes… Affected: 3.7 before 3.7.34; 3.8 before 3.8.34; 3.9 before 3.9.32; 4.0 before 4.0.31; 4.1 before 4.1.31; 4.2 before 4.2.28; +12 more |
| CVE-2015-5734 | – | Nov 9 | Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary… Affected: through 4.2.3 |
| CVE-2015-5733 | – | Nov 9 | Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject… Affected: through 4.2.3 |
| CVE-2015-5732 | – | Nov 9 | Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers… Affected: through 4.2.3 |
| CVE-2015-5731 | – | Nov 9 | Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests… Affected: through 4.2.3 |
| CVE-2015-5730 | – | Nov 9 | The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows… Affected: through 4.2.3 |
| CVE-2015-2213 | – | Nov 9 | SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands… Affected: through 4.2.3 |
| CVE-2015-3439 | – | Aug 5 | Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and… Affected: 3.9.0; 3.9.1; 3.9.2; 3.9.3; 4.0; 4.0.1; +2 more |
| CVE-2015-3438 | – | Aug 5 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or… Affected: through 4.1.1 |
| CVE-2015-5623 | – | Aug 3 | WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by… Affected: through 4.2.2 |
| CVE-2015-5622 | – | Aug 3 | Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor… Affected: through 4.2.2 |
| CVE-2015-3440 | – | Aug 3 | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that… Affected: through 4.2 |
| CVE-2014-9039 | – | Nov 25 | wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an… Affected: through 3.7.4; 3.8; 3.8.1; 3.8.2; 3.8.3; 3.8.4; +4 more |
| CVE-2014-9038 | – | Nov 25 | wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF)… Affected: through 3.7.4; 3.8; 3.8.1; 3.8.2; 3.8.3; 3.8.4; +4 more |
| CVE-2014-9037 | – | Nov 25 | WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an… Affected: through 3.7.4; 3.8; 3.8.1; 3.8.2; 3.8.3; 3.8.4; +4 more |
| CVE-2014-9036 | – | Nov 25 | Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web… Affected: through 3.7.4; 3.8; 3.8.1; 3.8.2; 3.8.3; 3.8.4; +4 more |
| CVE-2014-9035 | – | Nov 25 | Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject… Affected: through 3.7.4; 3.8; 3.8.1; 3.8.2; 3.8.3; 3.8.4; +4 more |
| CVE-2014-9034 | – | Nov 25 | wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU… Affected: through 3.7.4; 3.8; 3.8.1; 3.8.2; 3.8.3; 3.8.4; +4 more |
| CVE-2014-9033 | – | Nov 25 | Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users… Affected: 3.7.4; 3.8.4; 3.9.2; 4.0 |
| CVE-2014-9032 | – | Nov 25 | Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web… Affected: 3.9; 3.9.1; 3.9.2; 4.0 |
| CVE-2014-9031 | – | Nov 25 | Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject… Affected: through 3.7.4; 3.8; 3.8.1; 3.8.2; 3.8.3; 3.8.4; +3 more |
| CVE-2003-1599 | – | Oct 27 | PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the $abspath variable Affected: 0.70 |
| CVE-2003-1598 | – | Oct 1 | SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable Affected: through 0.7 |
| CVE-2014-5266 | – | Aug 18 | The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document,… Affected: through 3.9.1; 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +26 more |
| CVE-2014-5265 | – | Aug 18 | The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion… Affected: through 3.9.1; 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +26 more |
| CVE-2014-5240 | – | Aug 18 | Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject… Affected: through 3.9.1; 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +26 more |
| CVE-2014-5205 | – | Aug 18 | wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote… Affected: through 3.9.1; 3.9.0 |
| CVE-2014-5204 | – | Aug 18 | wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it… Affected: through 3.9.1; 3.9.0 |