WO
CMS
WordPress
On CISA KEVExploited in the wild
364
CVEs
7
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 20High 47Medium 102Low 2
Watch
Add WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-63030 In wildKEV | 9.8 | Jul 17 | WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution Affected: 6.9.0 before 6.9.5; 7.0.0 before 7.0.2 |
| CVE-2020-25213 In wildKEV | 9.8 | Sep 9 | WordPress File Manager Plugin Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2016-10033 In wildKEV | 9.8 | Dec 30 | The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute… Affected: through 4.7 |
| CVE-2024-31211 | 9.8 | Apr 4 | WordPress is an open publishing platform for the Web Affected: 6.4.0 before 6.4.2 |
| CVE-2021-44223 | 9.8 | Nov 25 | WordPress before 5.8 lacks support for the Update URI plugin header Affected: before 5.8 |
| CVE-2020-36326 | 9.8 | Apr 28 | PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname Affected: 3.7 before 3.7.36; 3.8 before 3.8.36; 3.9 before 3.9.34; 4.0 before 4.0.33; 4.1 before 4.1.33; 4.2 before 4.2.30; +15 more |
| CVE-2020-28037 | 9.8 | Nov 2 | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a… Affected: before 5.5.2 |
| CVE-2020-28036 | 9.8 | Nov 2 | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post Affected: before 5.5.2 |
| CVE-2020-28035 | 9.8 | Nov 2 | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC Affected: before 5.5.2 |
| CVE-2020-28032 | 9.8 | Nov 2 | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php Affected: before 5.5.2 |
| CVE-2019-20041 | 9.8 | Dec 27 | wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by… Affected: before 5.3.1 |
| CVE-2019-17670 | 9.8 | Oct 17 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs Affected: before 5.2.4 |
| CVE-2019-17669 | 9.8 | Oct 17 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters Affected: before 5.2.4 |
| CVE-2018-20148 | 9.8 | Dec 14 | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call Affected: before 4.9.9; 5.0 before 5.0.1 |
| CVE-2017-16510 | 9.8 | Nov 2 | WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as… Affected: through 4.8.2 |
| CVE-2017-14723 | 9.8 | Sep 23 | Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and… Affected: through 4.8.1 |
| CVE-2017-5611 | 9.8 | Jan 30 | SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the… Affected: through 4.7.1 |
| CVE-2016-10045 | 9.8 | Dec 30 | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging… Affected: through 4.7 |
| CVE-2007-6013 | 9.8 | Nov 19 | Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the… Affected: 1.5 through 2.3.1 |
| CVE-2020-28039 | 9.1 | Nov 2 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered… Affected: before 5.5.2 |
Showing 20