WO
Vendor
WordPress
430
CVEs
7
On KEV
1
New 30D
Products
WO9.8
WordPress
CMS
364 CVEs7 on KEV1 new
WM–
Wordpress MU
Wordpress
10 CVEs0 on KEV0 new
SP–
Sniplets Plugin
Wordpress
3 CVEs0 on KEV0 new
BL–
Blix
Wordpress
2 CVEs0 on KEV0 new
MC–
Math Comment Spam Protection Plugin
Wordpress
2 CVEs0 on KEV0 new
PA–
Pay-with-tweet
Wordpress
2 CVEs0 on KEV0 new
WP–
Wassup Plugin
Wordpress
2 CVEs0 on KEV0 new
AD–
Adserve
Wordpress
1 CVEs0 on KEV0 new
AB–
Alert Before You Post
Wordpress
1 CVEs0 on KEV0 new
BL–
Blixed
Wordpress
1 CVEs0 on KEV0 new
BL–
Blixkrieg
Wordpress
1 CVEs0 on KEV0 new
BI8.8
Blogger Importer
Wordpress
1 CVEs0 on KEV0 new
CA–
Captcha
Wordpress
1 CVEs0 on KEV0 new
CR–
Cryptographp
Wordpress
1 CVEs0 on KEV0 new
DL–
Dean Logan Wp-people Plugin
Wordpress
1 CVEs0 on KEV0 new
DB6.1
Debug Bar
Wordpress
1 CVEs0 on KEV0 new
DM–
Download Monitor Plugin
Wordpress
1 CVEs0 on KEV0 new
FW–
Fcchat Widget
Wordpress
1 CVEs0 on KEV0 new
FI–
Filemanager
Wordpress
1 CVEs0 on KEV0 new
GC5.3
Geo Controller
Wordpress
1 CVEs0 on KEV0 new
GU5.4
Gutenberg
Wordpress
1 CVEs0 on KEV0 new
HC8.8
Health Check & Troubleshooting
Wordpress
1 CVEs0 on KEV0 new
LS–
Lanoba Social Plugin
Wordpress
1 CVEs0 on KEV0 new
PF–
Page Flip Image Gallery Plugin
Wordpress
1 CVEs0 on KEV0 new
PL8.8
Performance Lab
Wordpress
1 CVEs0 on KEV0 new
PM–
Permalinks Migration Plugin
Wordpress
1 CVEs0 on KEV0 new
PM–
Peter's Math Anti-spam For Wordpress
Wordpress
1 CVEs0 on KEV0 new
PA–
Photo Album Plugin
Wordpress
1 CVEs0 on KEV0 new
PI–
Pictpress
Wordpress
1 CVEs0 on KEV0 new
PN–
Plugin Newsletter Plugin
Wordpress
1 CVEs0 on KEV0 new
PO–
Pool
Wordpress
1 CVEs0 on KEV0 new
RE9.8
Requests
Wordpress
1 CVEs0 on KEV0 new
SU–
Search Unleashed Plugin
Wordpress
1 CVEs0 on KEV0 new
SI–
Sirius
Wordpress
1 CVEs0 on KEV0 new
SG–
Slideshow Gallery2
Wordpress
1 CVEs0 on KEV0 new
SP–
Spambam Plugin
Wordpress
1 CVEs0 on KEV0 new
SN–
ST Newsletter Plugin
Wordpress
1 CVEs0 on KEV0 new
TT7.2
Thanh Toan Quet MA QR Code TU Dong
Wordpress
1 CVEs0 on KEV0 new
UT–
Unamed Theme
Wordpress
1 CVEs0 on KEV0 new
UT–
Unamed Theme SE
Wordpress
1 CVEs0 on KEV0 new
UF–
Upload File Plugin
Wordpress
1 CVEs0 on KEV0 new
WO–
Wordpress-users
Wordpress
1 CVEs0 on KEV0 new
WO–
Wordpressclassic
Wordpress
1 CVEs0 on KEV0 new
WO–
Wordspew
Wordpress
1 CVEs0 on KEV0 new
WC–
WP Cal Plugin
Wordpress
1 CVEs0 on KEV0 new
WP–
Wp-contactform
Wordpress
1 CVEs0 on KEV0 new
WD–
WP Download
Wordpress
1 CVEs0 on KEV0 new
WD–
WP Downloads Manager
Wordpress
1 CVEs0 on KEV0 new
WP–
Wp-footnotes
Wordpress
1 CVEs0 on KEV0 new
WF–
WP Forum
Wordpress
1 CVEs0 on KEV0 new
WM–
WP Maintenance Mode Plugin
Wordpress
1 CVEs0 on KEV0 new
WP–
Wpss
Wordpress
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114570 New | WO WordPress WordPress | 4.9 | Oct 22 | WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit |
| CVE-2026-87902 In wildKEV | WO WordPress WordPress | 8.1 | Sep 22 | WordPress Core Remote File Inclusion Vulnerability |
| CVE-2026-65640 | WO WordPress WordPress | 8.8 | Aug 17 | WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher |
| CVE-2026-64638 | WO WordPress WordPress | 8.9 | Aug 7 | WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen |
| CVE-2026-45293 | WO WordPress WordPress | 8.6 | Jul 28 | WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability |
| CVE-2026-63030 In wildKEV | WO WordPress WordPress | 9.8 | Jul 17 | WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution |
| CVE-2026-60137 In wildKEV | WO WordPress WordPress | 5.9 | Jul 17 | WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query |
| CVE-2020-37233 | WO WordPress WordPress | 6.4 | May 16 | WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting |
| CVE-2022-4973 | WO WordPress WordPress | 5.4 | Oct 16 | WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page… |
| CVE-2024-8914 | TT Thanh Toan Quet MA QR Code TU Dong Wordpress | 7.2 | Sep 25 | The Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to,… |
| CVE-2024-7381 | GC Geo Controller Wordpress | 5.3 | Sep 5 | Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution |
| CVE-2024-4439 | WO WordPress WordPress | 6.1 | May 3 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the… |
| CVE-2024-31211 | WO WordPress WordPress | 9.8 | Apr 4 | WordPress is an open publishing platform for the Web |
| CVE-2024-31210 | WO WordPress WordPress | 8.8 | Apr 4 | WordPress is an open publishing platform for the Web |
| CVE-2023-5561 | WO WordPress WordPress | 5.3 | Oct 16 | WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have… |
| CVE-2023-39999 | WO WordPress WordPress | 4.3 | Oct 13 | WordPress < 6.3.2 is vulnerable to Broken Access Control |
| CVE-2023-38000 | WO WordPress WordPress | 5.4 | Oct 13 | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5,… |
| CVE-2013-10027 | BI Blogger Importer Wordpress | 8.8 | Jun 4 | A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress |
| CVE-2022-47174 | PL Performance Lab Wordpress | 8.8 | May 25 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <= 2.2.0 versions |
| CVE-2022-47161 | HC Health Check & Troubleshooting Wordpress | 8.8 | May 25 | Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions |
| CVE-2023-2745 | WO WordPress WordPress | 5.4 | May 17 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter |
| CVE-2013-10021 | DB Debug Bar Wordpress | 6.1 | Mar 11 | A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress |
| CVE-2023-22622 | WO WordPress WordPress | 5.3 | Jan 5 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where… |
| CVE-2022-3590 | WO WordPress WordPress | 5.9 | Dec 14 | WordPress is affected by an unauthenticated blind SSRF in the pingback feature |
| CVE-2022-43504 | WO WordPress WordPress | 5.3 | Dec 5 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using… |
| CVE-2022-43500 | WO WordPress WordPress | 6.1 | Dec 5 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script |
| CVE-2022-43497 | WO WordPress WordPress | 6.1 | Dec 5 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script |
| CVE-2011-1762 | WO WordPress WordPress | 6.5 | Apr 18 | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts |
| CVE-2022-21664 | WO WordPress WordPress | 8.8 | Jan 6 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database |
| CVE-2022-21663 | WO WordPress WordPress | 7.2 | Jan 6 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database |
| CVE-2022-21662 | WO WordPress WordPress | 5.4 | Jan 6 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database |
| CVE-2022-21661 | WO WordPress WordPress | 7.5 | Jan 6 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database |
| CVE-2021-44223 | WO WordPress WordPress | 9.8 | Nov 25 | WordPress before 5.8 lacks support for the Update URI plugin header |
| CVE-2021-39203 | WO WordPress WordPress | 6.5 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database |
| CVE-2021-39202 | WO WordPress WordPress | 5.4 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database |
| CVE-2021-39201 | WO WordPress WordPress | 5.4 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database |
| CVE-2021-39200 | WO WordPress WordPress | 5.3 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database |
| CVE-2020-36326 | WO WordPress WordPress | 9.8 | Apr 28 | PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname |
| CVE-2021-29476 | RE Requests Wordpress | 9.8 | Apr 27 | Requests is a HTTP library written in PHP |
| CVE-2021-29450 | WO WordPress WordPress | 4.3 | Apr 15 | Wordpress is an open source CMS |
| CVE-2021-29447 | WO WordPress WordPress | 6.5 | Apr 15 | Wordpress is an open source CMS |
| CVE-2020-28040 | WO WordPress WordPress | 4.3 | Nov 2 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image |
| CVE-2020-28039 | WO WordPress WordPress | 9.1 | Nov 2 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered… |
| CVE-2020-28038 | WO WordPress WordPress | 6.1 | Nov 2 | WordPress before 5.5.2 allows stored XSS via post slugs |
| CVE-2020-28037 | WO WordPress WordPress | 9.8 | Nov 2 | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a… |
| CVE-2020-28036 | WO WordPress WordPress | 9.8 | Nov 2 | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post |
| CVE-2020-28035 | WO WordPress WordPress | 9.8 | Nov 2 | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC |
| CVE-2020-28034 | WO WordPress WordPress | 6.1 | Nov 2 | WordPress before 5.5.2 allows XSS associated with global variables |
| CVE-2020-28033 | WO WordPress WordPress | 7.5 | Nov 2 | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed |
| CVE-2020-28032 | WO WordPress WordPress | 9.8 | Nov 2 | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php |
| CVE-2020-25286 | WO WordPress WordPress | 5.3 | Sep 13 | In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public |
| CVE-2020-25213 In wildKEV | WO WordPress WordPress | 9.8 | Sep 9 | WordPress File Manager Plugin Remote Code Execution Vulnerability |
| CVE-2020-4050 | WO WordPress WordPress | 3.1 | Jun 12 | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved |
| CVE-2020-4049 | WO WordPress WordPress | 2.4 | Jun 12 | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes… |
| CVE-2020-4048 | WO WordPress WordPress | 5.7 | Jun 12 | In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect… |
| CVE-2020-4047 | WO WordPress WordPress | 6.8 | Jun 12 | In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way |
| CVE-2020-4046 | WO WordPress WordPress | 5.4 | Jun 12 | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor |
| CVE-2020-11030 | WO WordPress WordPress | 5.4 | Apr 30 | In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor |
| CVE-2020-11029 | WO WordPress WordPress | 6.1 | Apr 30 | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks |
| CVE-2020-11028 | WO WordPress WordPress | 7.5 | Apr 30 | In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions |