WO
CMS
WordPress
On CISA KEVExploited in the wild
364
CVEs
7
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 20High 47Medium 102Low 2
Watch
Add WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2008-0191 | – | Jan 10 | WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2 action to the default URI, which reveals the full path and… Affected: 2.2; 2.3 |
| CVE-2007-6318 | – | Dec 12 | SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute arbitrary SQL commands via the s parameter, when DB_CHARSET… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +18 more |
| CVE-2007-5710 | – | Oct 30 | Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inject arbitrary web script or HTML via the posts_columns array… Affected: 2.3 |
| CVE-2007-5106 | – | Sep 26 | Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 allows remote attackers to inject arbitrary web script or HTML via the user_login parameter Affected: 2.0 |
| CVE-2007-5105 | – | Sep 26 | Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 and 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the user_email parameter Affected: 2.0; 2.0.1 |
| CVE-2007-4894 | – | Sep 14 | Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remote attackers to execute arbitrary SQL commands via the… Affected: 0.6.2; 0.6.2.1; 0.7; 0.71; 1.2; 1.2.1; +25 more |
| CVE-2007-4893 | – | Sep 14 | wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly verify the unfiltered_html privilege, which allows remote… Affected: 0.6.2; 0.6.2.1; 0.7; 0.71; 1.2; 1.2.1; +25 more |
| CVE-2007-4154 | – | Aug 3 | SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arbitrary SQL commands via the page_options parameter to (1)… Affected: 2.2.1 |
| CVE-2007-4153 | – | Aug 3 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) the Options… Affected: 2.2.1 |
| CVE-2007-4139 | – | Aug 3 | Cross-site scripting (XSS) vulnerability in the Temporary Uploads editing functionality (wp-admin/includes/upload.php) in WordPress 2.2.1, allows remote attackers to inject… Affected: 2.2.1 |
| CVE-2007-3639 | – | Jul 10 | WordPress before 2.2.2 allows remote attackers to redirect visitors to other websites and potentially obtain sensitive information via (1) the _wp_http_referer parameter to… Affected: through 2.2.1 |
| CVE-2007-3544 | – | Jul 3 | Unrestricted file upload vulnerability in (1) wp-app.php and (2) app.php in WordPress 2.2.1 and WordPress MU 1.2.3 allows remote authenticated users to upload and execute… Affected: through 2.2.0 |
| CVE-2007-3543 | – | Jul 3 | Unrestricted file upload vulnerability in WordPress before 2.2.1 and WordPress MU before 1.2.3 allows remote authenticated users to upload and execute arbitrary PHP code by making… Affected: through 2.2.0 |
| CVE-2007-3241 | – | Jun 15 | Cross-site scripting (XSS) vulnerability in blogroll.php in the cordobo-green-park theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the… Affected: 2.2 |
| CVE-2007-3240 | – | Jun 15 | Cross-site scripting (XSS) vulnerability in 404.php in the Vistered-Little theme for WordPress allows remote attackers to inject arbitrary web script or HTML via the URI… Affected: 2.2 |
| CVE-2007-3239 | – | Jun 15 | Cross-site scripting (XSS) vulnerability in searchform.php in the AndyBlue theme before 20070607 for WordPress allows remote attackers to inject arbitrary web script or HTML via… Affected: 2.2 |
| CVE-2007-3238 | – | Jun 15 | Cross-site scripting (XSS) vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authenticated administrators to inject arbitrary web script or HTML… Affected: 2.2 |
| CVE-2007-3140 | – | Jun 8 | SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL commands via a parameter value in an XML RPC… Affected: 2.2 |
| CVE-2007-2821 | – | May 22 | SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via the cookie parameter Affected: through 2.1.3 |
| CVE-2007-2627 | – | May 11 | Cross-site scripting (XSS) vulnerability in sidebar.php in WordPress, when custom 404 pages that call get_sidebar are used, allows remote attackers to inject arbitrary web script… Affected: All versions, or not specified |
| CVE-2007-1897 | – | Apr 9 | SQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQL commands via a string… Affected: through 2.1.2; 2.1; 2.1.1 |
| CVE-2007-1894 | – | Apr 9 | Cross-site scripting (XSS) vulnerability in wp-includes/general-template.php in WordPress before 20070309 allows remote attackers to inject arbitrary web script or HTML via the… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +6 more |
| CVE-2007-1893 | – | Apr 9 | xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the… Affected: through 2.1.2 |
| CVE-2007-1732 | – | Mar 28 | Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML… Affected: 2.1.2 |
| CVE-2007-1622 | – | Mar 23 | Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote authenticated users with theme… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +8 more |
| CVE-2007-1599 | – | Mar 22 | wp-login.php in WordPress allows remote attackers to redirect authenticated users to other websites and potentially obtain sensitive information via the redirect_to parameter Affected: 2.1.2 |
| CVE-2007-1409 | – | Mar 10 | WordPress allows remote attackers to obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the path in an error message Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +4 more |
| CVE-2007-1277 | – | Mar 5 | WordPress 2.1.1, as downloaded from some official distribution sites during February and March 2007, contains an externally introduced backdoor that allows remote attackers to… Affected: 2.1.1 |
| CVE-2007-1244 | – | Mar 3 | Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as… Affected: through 2.1.1 |
| CVE-2007-1230 | – | Mar 2 | Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow remote attackers to inject arbitrary web script or HTML via… Affected: 2.1 |
| CVE-2007-1049 | – | Feb 21 | Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before… Affected: 0.6.2; 0.6.2.1; 0.7; 0.71; 1.2.2; 1.5; +14 more |
| CVE-2007-0541 | – | Jan 29 | WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that… Affected: through 2.0 |
| CVE-2007-0540 | – | Jan 29 | WordPress allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to a file with a… Affected: through 2.0 |
| CVE-2007-0539 | – | Jan 29 | The wp_remote_fopen function in WordPress before 2.1 allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a… Affected: through 2.0 |
| CVE-2007-0262 | – | Jan 16 | WordPress 2.0.6, and 2.1Alpha 3 (SVN:4662), does not properly verify that the m parameter value has the string data type, which allows remote attackers to obtain sensitive… Affected: 2.0.6; 2.1 |
| CVE-2007-0233 | – | Jan 13 | wp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric… Affected: 0.6.2; 0.6.2.1; 0.7; 0.71; 1.2; 1.2.1; +13 more |
| CVE-2007-0109 | – | Jan 9 | wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5 |
| CVE-2007-0107 | – | Jan 9 | WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection… Affected: through 2.0.5 |
| CVE-2007-0106 | – | Jan 9 | Cross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6 allows remote attackers to inject arbitrary web script or HTML via a CSRF attack… Affected: 2.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5 |
| CVE-2006-6808 | – | Dec 28 | Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter Affected: through 2.0.5; 0.6.2; 0.6.2.1; 0.7; 0.71; 1.2; +12 more |
| CVE-2006-5705 | – | Nov 4 | Multiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0.5 allow remote authenticated users to read or overwrite arbitrary files via… Affected: through 2.0.4; 2.0.2; 2.0.3 |
| CVE-2006-4743 | – | Sep 13 | WordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a direct request for (1) 404.php, (2) akismet.php, (3) archive.php, (4) archives.php, (5)… Affected: 2.0.2; 2.0.3; 2.0.4; 2.0.5 |
| CVE-2006-4028 | – | Aug 9 | Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and remote attack vectors Affected: 2.0; 2.0.1; 2.0.2; 2.0.3 |
| CVE-2006-3390 | – | Jul 6 | WordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to various files, such as those in the (1) wp-admin, (2) wp-content, and (3)… Affected: 2.0.3 |
| CVE-2006-3389 | – | Jul 6 | index.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL table prefixes, via an invalid paged parameter, which displays the information in… Affected: 2.0.3 |
| CVE-2006-2702 | – | May 31 | vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC_REMOTE_ADDR HTTP header, which vars.php uses to redefine… Affected: 2.0.2 |
| CVE-2006-2667 | – | May 30 | Direct static code injection vulnerability in WordPress 2.0.2 and earlier allows remote attackers to execute arbitrary commands by inserting a carriage return and PHP code when… Affected: through 2.0.2 |
| CVE-2006-1796 | – | Apr 17 | Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions before 2.0.1, allows… Affected: through 2.0; 0.6.2; 0.6.2.1; 0.7; 0.71; 1.0; +11 more |
| CVE-2006-1263 | – | Mar 19 | Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack… Affected: 0.6.2; 0.6.2.1; 0.7; 0.71; 1.2; 1.2.1; +8 more |
| CVE-2006-1012 | – | Mar 6 | SQL injection vulnerability in WordPress 1.5.2, and possibly other versions before 2.0, allows remote attackers to execute arbitrary SQL commands via the User-Agent field in an… Affected: 1.5.2 |