WO
CMS
WordPress
On CISA KEVExploited in the wild
365
CVEs
7
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 20High 47Medium 103Low 2
Watch
Add WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2012-0937 | – | Jan 30 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which… Affected: through 3.3.1; 0.7; 0.71; 0.72; 0.711; 1.0; +34 more |
| CVE-2012-0782 | – | Jan 30 | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject… Affected: through 3.3.1; 0.7; 0.71; 0.72; 0.711; 1.0; +34 more |
| CVE-2011-4899 | – | Jan 30 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows… Affected: through 3.3.1; 0.7; 0.71; 0.72; 0.711; 1.0; +34 more |
| CVE-2011-4898 | – | Jan 30 | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on… Affected: through 3.3.1; 0.7; 0.71; 0.72; 0.711; 1.0; +34 more |
| CVE-2012-0287 | – | Jan 6 | Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web… Affected: 3.3 |
| CVE-2011-3818 | – | Sep 24 | WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as… Affected: 2.9.2; 3.0.4 |
| CVE-2011-3130 | – | Aug 10 | wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibly involving SQL… Affected: 3.1; 3.1.1; 3.1.2; 3.2 |
| CVE-2011-3129 | – | Aug 10 | The file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running "on hosts with dangerous security settings," has unknown impact and attack vectors,… Affected: 3.1; 3.1.1; 3.1.2; 3.2 |
| CVE-2011-3128 | – | Aug 10 | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to… Affected: 3.1; 3.1.1; 3.1.2; 3.2 |
| CVE-2011-3127 | – | Aug 10 | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party HTML document, which makes it easier… Affected: 3.1; 3.1.1; 3.1.2; 3.2 |
| CVE-2011-3126 | – | Aug 10 | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects Affected: 3.1; 3.1.1; 3.1.2; 3.2 |
| CVE-2011-3125 | – | Aug 10 | Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various security hardening." Affected: 3.1; 3.1.1; 3.1.2; 3.2 |
| CVE-2011-3122 | – | Aug 10 | Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media security." Affected: 3.1; 3.1.1; 3.1.2; 3.2 |
| CVE-2011-0701 | – | Mar 14 | wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified… Affected: through 3.0.4 |
| CVE-2011-0700 | – | Mar 14 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1)… Affected: through 3.0.4 |
| CVE-2010-4536 | – | Jan 3 | Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related… Affected: through 3.0.3 |
| CVE-2010-4257 | – | Dec 7 | SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands… Affected: through 3.0.1 |
| CVE-2010-0682 | – | Feb 23 | WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter Affected: 2.9; 2.9.1; 2.9.1; 2.9.1 |
| CVE-2009-3891 | – | Nov 17 | Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s… Affected: through 2.8.5 |
| CVE-2009-3890 | – | Nov 17 | Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime… Affected: through 2.8.5 |
| CVE-2009-3622 | – | Oct 23 | Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU consumption and server hang) via a… Affected: through 2.8.4 |
| CVE-2009-2854 | – | Aug 18 | Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1)… Affected: through 2.8.2 |
| CVE-2009-2853 | – | Aug 18 | Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4)… Affected: 0.71; 0.71; 0.71; 0.72; 0.72; 0.72; +34 more |
| CVE-2009-2851 | – | Aug 18 | Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via a comment… Affected: through 2.8.1 |
| CVE-2009-2762 | – | Aug 13 | wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array… Affected: through 2.8.3 |
| CVE-2009-2432 | – | Jul 10 | WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an… Affected: through 2.7.1; 0.6.2; 0.6.2; 0.6.2.1; 0.6.2.1; 0.7; +34 more |
| CVE-2009-2431 | – | Jul 10 | WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source Affected: 2.7.1 |
| CVE-2009-2336 | – | Jul 10 | The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which… Affected: before 2.8.1 |
| CVE-2009-2335 | – | Jul 10 | WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to… Affected: before 2.8.1 |
| CVE-2009-2334 | – | Jul 10 | wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers… Affected: through 2.7.1; 0.6.2; 0.6.2; 0.6.2.1; 0.6.2.1; 0.7; +34 more |
| CVE-2008-6767 | – | Apr 28 | wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cause a denial of service (application outage), via a direct… Affected: 2.6 |
| CVE-2008-6762 | – | Apr 28 | Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via… Affected: 2.6 |
| CVE-2008-5695 | – | Dec 19 | wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests to update an option, which allows remote authenticated… Affected: through 2.3.2 |
| CVE-2008-5278 | – | Nov 28 | Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) for WordPress before 2.6.5 allows remote attackers to inject… Affected: through 2.6.3; 0.6.2; 0.6.2; 0.6.2.1; 0.6.2.1; 0.7; +34 more |
| CVE-2008-5113 | – | Nov 17 | WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remote attackers to conduct delayed and persistent cross-site… Affected: 2.6.3 |
| CVE-2008-4796 | – | Oct 30 | The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost,… Affected: before 2.6.3 |
| CVE-2008-4769 | – | Oct 28 | Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and earlier, and 2.5, allows remote attackers to include and… Affected: through 2.3.3; 0.6.2; 0.6.2; 0.6.2.1; 0.6.2.1; 0.7; +34 more |
| CVE-2008-4106 | – | Sep 18 | WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maximum column width of the user_login column, and does not… Affected: through 2.6.1; 0.71-gold; 1.0-platinum; 1.0.1-miles; 1.0.2-blakey; 1.2-delta; +28 more |
| CVE-2008-3747 | – | Aug 27 | The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before 2.6.1 do not force SSL communication in the intended… Affected: 0.6.2; 0.6.2.1; 0.7; 0.71; 0.72; 0.72; +34 more |
| CVE-2008-3233 | – | Jul 18 | Cross-site scripting (XSS) vulnerability in WordPress before 2.6, SVN development versions only, allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: through 2.5.1; 0.6.2; 0.6.2.1; 0.7; 0.71; 0.711; +34 more |
| CVE-2008-2392 | – | May 21 | Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload… Affected: through 2.5.1 |
| CVE-2008-2146 | – | May 12 | wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF), which allows remote attackers to bypass intended access… Affected: through 2.2.2; 0.6.2; 0.6.2.1; 0.7; 0.71; 0.711; +34 more |
| CVE-2008-2068 | – | May 2 | Cross-site scripting (XSS) vulnerability in WordPress 2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 2.5 |
| CVE-2008-1930 | – | Apr 28 | The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXPIRY_TIME, which allows remote attackers to forge cookies by… Affected: 2.5 |
| CVE-2008-1304 | – | Mar 12 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) inviteemail parameter in an invite… Affected: 2.3.2 |
| CVE-2008-0664 | – | Feb 8 | The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attackers to edit posts of other blog users via unknown vectors Affected: 0.7; 0.71; 1.2; 1.2.1; 1.2.2; 1.3.1; +32 more |
| CVE-2008-0196 | – | Jan 10 | Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary files via a Affected: through 2.0.11 |
| CVE-2008-0195 | – | Jan 10 | WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals… Affected: through 2.0.11 |
| CVE-2008-0194 | – | Jan 10 | Directory traversal vulnerability in wp-db-backup.php in WordPress 2.0.3 and earlier allows remote attackers to read arbitrary files, delete arbitrary files, and cause a denial of… Affected: through 2.0.3 |
| CVE-2008-0193 | – | Jan 10 | Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web… Affected: through 2.0.11; 2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.3_rc1; +9 more |