WO
CMS
WordPress
On CISA KEVExploited in the wild
369
CVEs
7
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 20High 48Medium 105Low 3
Watch
Add WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-5240 | – | Aug 18 | Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject… Affected: through 3.9.1; 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +26 more |
| CVE-2014-5205 | – | Aug 18 | wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote… Affected: through 3.9.1; 3.9.0 |
| CVE-2014-5204 | – | Aug 18 | wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it… Affected: through 3.9.1; 3.9.0 |
| CVE-2014-5203 | – | Aug 18 | wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted… Affected: 3.9.0; 3.9.1 |
| CVE-2014-0166 | – | Apr 10 | The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication… Affected: through 3.7.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2014-0165 | – | Apr 10 | WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and… Affected: through 3.7.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2012-6635 | – | Jan 21 | wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain… Affected: through 3.3.2; 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +12 more |
| CVE-2012-6634 | – | Jan 21 | wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a post_id value Affected: through 3.3.2; 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +12 more |
| CVE-2012-6633 | – | Jan 21 | Cross-site scripting (XSS) vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via an… Affected: through 3.3.2; 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +12 more |
| CVE-2011-5270 | – | Jan 21 | wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticated users to perform publish actions by… Affected: through 3.0.5; 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4 |
| CVE-2010-5297 | – | Jan 21 | WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote… Affected: through 3.0; 2.0; 2.0.1; 2.0.2; 2.0.4; 2.0.5; +34 more |
| CVE-2010-5296 | – | Jan 21 | wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows… Affected: through 3.0.1; 2.0; 2.0.1; 2.0.2; 2.0.4; 2.0.5; +34 more |
| CVE-2010-5295 | – | Jan 21 | Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's… Affected: through 3.0.1; 2.0; 2.0.1; 2.0.2; 2.0.4; 2.0.5; +34 more |
| CVE-2010-5294 | – | Jan 21 | Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allow remote servers to… Affected: through 3.0.1; 2.0; 2.0.1; 2.0.2; 2.0.4; 2.0.5; +34 more |
| CVE-2010-5293 | – | Jan 21 | wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote attackers to bypass intended spam… Affected: through 3.0.1; 2.0; 2.0.1; 2.0.2; 2.0.4; 2.0.5; +34 more |
| CVE-2013-7240 | – | Jan 3 | Directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a Affected: All versions, or not specified |
| CVE-2013-7233 | – | Dec 30 | Cross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options-discussion.php in WordPress 2.0.11 and earlier allows remote attackers to hijack the… Affected: through 2.0.11; 2.0; 2.0.1; 2.0.2; 2.0.4; 2.0.5; +5 more |
| CVE-2013-5739 | – | Sep 12 | The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct… Affected: through 3.6 |
| CVE-2013-5738 | – | Sep 12 | The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files,… Affected: through 3.6 |
| CVE-2013-4340 | – | Sep 12 | wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified… Affected: through 3.6 |
| CVE-2013-4339 | – | Sep 12 | WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted… Affected: through 3.6 |
| CVE-2013-4338 | – | Sep 12 | wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by… Affected: through 3.6 |
| CVE-2012-3414 | – | Jul 19 | Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products,… Affected: through 3.3.1; 3.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; +10 more |
| CVE-2013-2205 | – | Jul 8 | The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the Same Origin Policy… Affected: through 3.5.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2013-2204 | – | Jul 8 | moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign)… Affected: through 3.5.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2013-2203 | – | Jul 8 | WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the… Affected: through 3.5.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2013-2202 | – | Jul 8 | WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity… Affected: through 3.5.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2013-2201 | – | Jul 8 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of… Affected: through 3.5.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2013-2200 | – | Jul 8 | WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship… Affected: through 3.5.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2013-2199 | – | Jul 8 | The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF)… Affected: through 3.5.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2013-0237 | – | Jul 8 | Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject… Affected: through 3.5.0; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2013-0236 | – | Jul 8 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery… Affected: through 3.5.0; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2013-0235 | – | Jul 8 | The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL… Affected: through 3.5.0; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2013-2173 | – | Jun 21 | wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to cause a denial of service (CPU consumption) via a crafted value… Affected: 3.5.1 |
| CVE-2012-6527 | – | Jan 31 | Cross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO Affected: All versions, or not specified |
| CVE-2012-5868 | – | Dec 27 | WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session… Affected: 3.4.2 |
| CVE-2011-5216 | – | Oct 25 | SQL injection vulnerability in ajax.php in SCORM Cloud For WordPress plugin before 1.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the active… Affected: All versions, or not specified |
| CVE-2012-4448 | – | Sep 28 | Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that… Affected: 3.4.2 |
| CVE-2012-4422 | – | Sep 14 | wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide… Affected: through 3.4.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2012-4421 | – | Sep 14 | The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass… Affected: through 3.4.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2010-5106 | – | Sep 14 | The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended… Affected: through 3.0.2; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2012-4271 | – | Aug 13 | Multiple cross-site scripting (XSS) vulnerabilities in bad-behavior-wordpress-admin.php in the Bad Behavior plugin before 2.0.47 and 2.2.x before 2.2.5 for WordPress allow remote… Affected: All versions, or not specified |
| CVE-2012-3385 | – | Jul 22 | WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive… Affected: through 3.4.0; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2012-3384 | – | Jul 22 | Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown… Affected: through 3.4.0; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2012-3383 | – | Jul 22 | The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html… Affected: 3.4.0 |
| CVE-2011-4957 | – | Jun 27 | The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote… Affected: through 3.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2011-4956 | – | Jun 27 | Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 3.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2012-1936 | – | May 3 | The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it… Affected: through 3.3.1; 1.0; 1.0.1; 1.0.2; 1.1.1; 1.2; +34 more |
| CVE-2012-2404 | – | Apr 21 | wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified… Affected: through 3.3.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |
| CVE-2012-2403 | – | Apr 21 | wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site… Affected: through 3.3.1; 0.71; 1.0; 1.0.1; 1.0.2; 1.1.1; +34 more |