Skip to contentWordpress vulnerabilities
Newest
- wordpressWordPress before 2.2.2 allows remote attackers to redirect visitors to other websites and...CVE-2007-3639Fix available4.0 Medium
- wordpress, wordpress mu +1 moreUnrestricted file upload vulnerability in (1) wp-app.php and (2) app.php in WordPress 2.2.1 and...CVE-2007-3544Fix available6.5 Medium
- wordpress, wordpress mu +1 moreUnrestricted file upload vulnerability in WordPress before 2.2.1 and WordPress MU before 1.2.3...CVE-2007-3543Fix available6.0 Medium
- wordpressCross-site scripting (XSS) vulnerability in blogroll.php in the cordobo-green-park theme for...CVE-2007-32414.3 Medium
- wordpressCross-site scripting (XSS) vulnerability in 404.php in the Vistered-Little theme for WordPress...CVE-2007-32404.3 Medium
- wordpressCross-site scripting (XSS) vulnerability in searchform.php in the AndyBlue theme before 20070607...CVE-2007-32394.3 Medium
- wordpressCross-site scripting (XSS) vulnerability in functions.php in the default theme in WordPress 2.2...CVE-2007-3238Fix available6.0 Medium
- wordpressSQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to...CVE-2007-3140Public exploitFix available6.5 Medium
- wordpressSQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote...CVE-2007-2821Public exploitFix available7.5 High
- wordpressCross-site scripting (XSS) vulnerability in sidebar.php in WordPress, when custom 404 pages that...CVE-2007-2627Fix available6.8 Medium
- wordpress wordpressclassicCross-site scripting (XSS) vulnerability in index.php in the WordPress Classic 1.5 theme in...CVE-2007-4483Fix available4.3 Medium
- wordpressSQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier,...CVE-2007-1897Public exploitFix available6.5 Medium
- wordpressCross-site scripting (XSS) vulnerability in wp-includes/general-template.php in WordPress before...CVE-2007-1894Fix available4.3 Medium
- wordpressxmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users...CVE-2007-1893Fix available4.9 Medium
- wordpress** DISPUTED ** Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in...CVE-2007-1732Fix availableDisputed3.5 Low
- wordpressCross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and...CVE-2007-1622Public exploitFix available4.3 Medium
- wordpresswp-login.php in WordPress allows remote attackers to redirect authenticated users to other...CVE-2007-1599Fix available6.5 Medium
- wordpressWordPress allows remote attackers to obtain sensitive information via a direct request for wp...CVE-2007-14095.0 Medium
- wordpressWordPress 2.1.1, as downloaded from some official distribution sites during February and March...CVE-2007-1277Public exploitEPSS 27.8%7.5 High
- wordpressCross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier...CVE-2007-1244Public exploitFix available6.8 Medium
- wordpressMultiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress...CVE-2007-1230Fix available5.8 Medium
- wordpressCross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS...CVE-2007-1049Public exploitFix available4.3 Medium
- wordpressWordPress allows remote attackers to determine the existence of arbitrary files, and possibly...CVE-2007-0541Fix available5.0 Medium
- wordpressWordPress allows remote attackers to cause a denial of service (bandwidth or thread consumption)...CVE-2007-0540Public exploitFix available5.0 Medium
- wordpressThe wp_remote_fopen function in WordPress before 2.1 allows remote attackers to cause a denial of...CVE-2007-0539Fix available7.8 High
- wordpressWordPress 2.0.6, and 2.1Alpha 3 (SVN:4662), does not properly verify that the m parameter value...CVE-2007-0262Fix available7.8 High
- wordpresswp-trackback.php in WordPress 2.0.6 and earlier does not properly unset variables when the input...CVE-2007-0233Public exploitFix availableEPSS 11.7%7.5 High
- wordpresswp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or...CVE-2007-0109Fix available5.0 Medium
- wordpressWordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after...CVE-2007-0107Public exploitFix availableEPSS 11.7%6.8 Medium
- wordpressCross-site scripting (XSS) vulnerability in the CSRF protection scheme in WordPress before 2.0.6...CVE-2007-0106Fix available6.8 Medium
- wordpressCross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows...CVE-2006-6808Public exploitFix available6.8 Medium
- wordpressWordPress before 2.0.5 does not properly store a profile containing a string representation of a...CVE-2006-6017Fix available4.0 Medium
- wordpresswp-admin/user-edit.php in WordPress before 2.0.5 allows remote authenticated users to read the...CVE-2006-6016Fix available4.0 Medium
- wordpressMultiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0...CVE-2006-5705Fix available6.0 Medium
- wordpressWordPress 2.0.2 through 2.0.5 allows remote attackers to obtain sensitive information via a...CVE-2006-4743Fix available5.0 Medium
- wordpressMultiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and remote...CVE-2006-4028Fix available10.0 High
- wordpressWordPress 2.0.3 allows remote attackers to obtain the installation path via a direct request to...CVE-2006-3390Fix available5.0 Medium
- wordpressindex.php in WordPress 2.0.3 allows remote attackers to obtain sensitive information, such as SQL...CVE-2006-3389Fix available5.0 Medium
- wordpressvars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof...CVE-2006-2702Fix available5.0 Medium
- wordpressDirect static code injection vulnerability in WordPress 2.0.2 and earlier allows remote attackers...CVE-2006-2667Public exploitFix availableEPSS 14.5%7.5 High
- wordpressCross-site scripting (XSS) vulnerability in the paging links functionality in template-functions...CVE-2006-1796Fix available6.8 Medium
- wordpressMultiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow...CVE-2006-1263Fix available4.3 Medium
- wordpressSQL injection vulnerability in WordPress 1.5.2, and possibly other versions before 2.0, allows...CVE-2006-1012Fix available7.5 High
- wordpressWordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct...CVE-2006-0986Fix available5.0 Medium
- wordpressMultiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of...CVE-2006-0985Fix available4.3 Medium
- wordpress** DISPUTED ** Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote...CVE-2006-0733Public exploitDisputed2.6 Low
- wordpressWordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct...CVE-2005-4463Fix available5.0 Medium
- wordpressDirect code injection vulnerability in WordPress 1.5.1.3 and earlier allows remote attackers to...CVE-2005-2612Public exploitFix availableEPSS 38.8%7.5 High
- wordpressWordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via (1) a...CVE-2005-2110Fix available5.0 Medium
- wordpresswp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of...CVE-2005-2109Fix available5.0 Medium
- Show moreLoading…