WO
CMS
WordPress
On CISA KEVExploited in the wild
366
CVEs
7
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 20High 48Medium 103Low 2
Watch
Add WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-9978 In wildKEV | 6.1 | Mar 24 | WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability Affected: All versions, or not specified |
| CVE-2026-60137 In wildKEV | 5.9 | Jul 17 | WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query Affected: 6.8.0 before 6.8.6; 6.9.0 before 6.9.5; 7.0.0 before 7.0.2 |
| CVE-2020-4047 | 6.8 | Jun 12 | In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way Affected: 3.7 before 3.7.34; 3.8 before 3.8.34; 3.9 before 3.9.32; 4.0 before 4.0.31; 4.1 before 4.1.31; 4.2 before 4.2.28; +12 more |
| CVE-2011-1762 | 6.5 | Apr 18 | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts Affected: before 3.0.6; 3.1 before 3.1.2 |
| CVE-2021-39203 | 6.5 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database Affected: 5.8 |
| CVE-2021-29447 | 6.5 | Apr 15 | Wordpress is an open source CMS Affected: 5.6.0 before 5.7.1 |
| CVE-2019-8943 | 6.5 | Feb 20 | WordPress through 5.0.3 allows Path Traversal in wp_crop_image() Affected: through 5.0.3 |
| CVE-2018-20152 | 6.5 | Dec 14 | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input Affected: before 4.9.9; 5.0 before 5.0.1 |
| CVE-2018-20147 | 6.5 | Dec 14 | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files Affected: before 4.9.9; 5.0 before 5.0.1 |
| CVE-2017-14990 | 6.5 | Oct 3 | WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote… Affected: 4.8.2 |
| CVE-2017-6819 | 6.5 | Mar 12 | In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources Affected: through 4.7.2 |
| CVE-2016-6897 | 6.5 | Jan 18 | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to… Affected: through 4.5.5 |
| CVE-2006-6016 | 6.5 | Nov 21 | wp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the metadata of an arbitrary user via a modified user_id parameter Affected: through 2.0.4 |
| CVE-2006-6017 | 6.5 | Nov 21 | WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of… Affected: through 2.0.5 |
| CVE-2020-37233 | 6.4 | May 16 | WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting Affected: 6.2.0 |
| CVE-2016-7169 | 6.3 | Jan 5 | Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1… Affected: through 4.6 |
| CVE-2024-4439 | 6.1 | May 3 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the… Affected: 6.0 through 6.0.7; 6.1 through 6.1.5; 6.2 through 6.2.4; 6.3 through 6.3.3; 6.4.0 through 6.4.3; 6.5 through 6.5.1 |
| CVE-2022-43500 | 6.1 | Dec 5 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script Affected: before 3.7.40; 3.8 before 3.8.40; 3.9 before 3.9.39; 4.0 before 4.0.37; 4.1 before 4.1.37; 4.2 before 4.2.34; +18 more |
| CVE-2022-43497 | 6.1 | Dec 5 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script Affected: before 3.7.40; 3.8 before 3.8.40; 3.9 before 3.9.39; 4.0 before 4.0.37; 4.1 before 4.1.37; 4.2 before 4.2.34; +18 more |
| CVE-2020-28038 | 6.1 | Nov 2 | WordPress before 5.5.2 allows stored XSS via post slugs Affected: before 5.5.2 |
| CVE-2020-28034 | 6.1 | Nov 2 | WordPress before 5.5.2 allows XSS associated with global variables Affected: before 5.5.2 |
| CVE-2020-11029 | 6.1 | Apr 30 | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks Affected: 3.7 before 3.7.33; 3.8 before 3.8.33; 3.9 before 3.9.31; 4.0 before 4.0.30; 4.1 before 4.1.30; 4.2 before 4.2.27; +12 more |
| CVE-2019-20042 | 6.1 | Dec 27 | In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS)… Affected: 3.7 before 5.3.1 |
| CVE-2019-17672 | 6.1 | Oct 17 | WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements Affected: before 5.2.4 |
| CVE-2019-16222 | 6.1 | Sep 11 | WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks Affected: before 5.2.3 |
| CVE-2019-16221 | 6.1 | Sep 11 | WordPress before 5.2.3 allows reflected XSS in the dashboard Affected: before 5.2.3 |
| CVE-2019-16220 | 6.1 | Sep 11 | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not… Affected: before 5.2.3 |
| CVE-2019-16219 | 6.1 | Sep 11 | WordPress before 5.2.3 allows XSS in shortcode previews Affected: before 5.2.3 |
| CVE-2019-16218 | 6.1 | Sep 11 | WordPress before 5.2.3 allows XSS in stored comments Affected: before 5.2.3 |
| CVE-2019-16217 | 6.1 | Sep 11 | WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled Affected: before 5.2.3 |
| CVE-2018-20150 | 6.1 | Dec 14 | In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins Affected: before 4.9.9; 5.0 before 5.0.1 |
| CVE-2018-10102 | 6.1 | Apr 16 | Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag Affected: before 4.9.5 |
| CVE-2018-10101 | 6.1 | Apr 16 | Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server Affected: before 4.9.5 |
| CVE-2018-10100 | 6.1 | Apr 16 | Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS Affected: before 4.9.5 |
| CVE-2018-5776 | 6.1 | Jan 18 | WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement) Affected: before 4.9.2 |
| CVE-2017-14726 | 6.1 | Sep 23 | Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor Affected: through 4.8.1 |
| CVE-2017-14724 | 6.1 | Sep 23 | Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery Affected: through 4.8.1 |
| CVE-2017-14721 | 6.1 | Sep 23 | Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name Affected: through 4.8.1 |
| CVE-2017-14720 | 6.1 | Sep 23 | Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name Affected: through 4.8.1 |
| CVE-2017-14718 | 6.1 | Sep 23 | Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL Affected: through 4.8.1 |
| CVE-2017-9063 | 6.1 | May 18 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session Affected: through 4.7.4 |
| CVE-2017-9061 | 6.1 | May 18 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict… Affected: through 4.7.4 |
| CVE-2017-6818 | 6.1 | Mar 12 | In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names Affected: through 4.7.2 |
| CVE-2017-6815 | 6.1 | Mar 12 | In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation Affected: through 4.7.2 |
| CVE-2017-5612 | 6.1 | Jan 30 | Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject… Affected: through 4.7.1 |
| CVE-2017-5490 | 6.1 | Jan 15 | Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject… Affected: through 4.7 |
| CVE-2017-5488 | 6.1 | Jan 15 | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1)… Affected: through 4.7 |
| CVE-2016-6634 | 6.1 | Aug 7 | Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: through 4.4.4 |
| CVE-2016-5834 | 6.1 | Jun 29 | Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject… Affected: through 4.5.2 |
| CVE-2016-5833 | 6.1 | Jun 29 | Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to… Affected: through 4.5.2 |