Skip to contentWordpress vulnerabilities
Newest
- wordpressMultiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials...CVE-2010-5294Fix available4.3 Medium
- wordpresswp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and...CVE-2010-5293Fix available5.8 Medium
- westerndeal advanced dewplayer, wordpress +1 moreDirectory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for...CVE-2013-7240Public exploitEPSS 19.6%5.0 Medium
- wordpressCross-site request forgery (CSRF) vulnerability in the retrospam component in wp-admin/options...CVE-2013-7233Public exploit6.8 Medium
- wordpressThe default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe...CVE-2013-5739Fix available3.5 Low
- wordpressThe get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does...CVE-2013-5738Fix available4.3 Medium
- wordpresswp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof...CVE-2013-4340Fix available3.5 Low
- wordpressWordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which...CVE-2013-4339Fix available7.5 High
- wordpresswp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has...CVE-2013-4338Fix available7.5 High
- swfupload project swfupload, tinymce image manager, wordpress +2 moreCross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as...CVE-2012-3414Public exploitFix available4.3 Medium
- moxiecode plupload, wordpress, fedoraproject fedora +2 moreCross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as...CVE-2013-0237Fix available4.3 Medium
- wordpressMultiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote...CVE-2013-0236Fix available4.3 Medium
- wordpressThe XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to...CVE-2013-0235Fix availableEPSS 29.6%6.4 Medium
- wordpressThe default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security...CVE-2013-2205Fix available4.3 Medium
- tinymce media, wordpress +1 moremoxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before...CVE-2013-2204Fix available4.3 Medium
- wordpressWordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers...CVE-2013-2203Fix available4.3 Medium
- wordpressWordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider...CVE-2013-2202Fix available4.3 Medium
- wordpressMultiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote...CVE-2013-2201Fix available4.3 Medium
- wordpressWordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote...CVE-2013-2200Fix available4.0 Medium
- wordpressThe HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet...CVE-2013-2199Fix available4.3 Medium
- wordpress wp maintenance mode pluginCross-site request forgery (CSRF) vulnerability in the WP Maintenance Mode plugin before 1.8.8...CVE-2013-32506.8 Medium
- wordpresswp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows...CVE-2013-2173Fix available4.3 Medium
- joedolson my calendar, wordpress +1 moreCross-site scripting (XSS) vulnerability in the My Calendar plugin before 1.10.2 for WordPress...CVE-2012-65272.6 Low
- wordpressWordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout...CVE-2012-58682.6 Low
- troyef scorm cloud, wordpress +1 moreSQL injection vulnerability in ajax.php in SCORM Cloud For WordPress plugin before 1.0.7 for...CVE-2011-52167.5 High
- wordpress pay-with-tweetSQL injection vulnerability in the Pay With Tweet plugin before 1.2 for WordPress allows remote...CVE-2012-5350Public exploit6.0 Medium
- wordpress pay-with-tweetMultiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin...CVE-2012-5349Public exploit2.6 Low
- wordpress slideshow gallery2Cross-site scripting (XSS) vulnerability in css/gallery-css.php in the Slideshow Gallery2 plugin...CVE-2012-5229Public exploit4.3 Medium
- wordpressCross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows...CVE-2012-4448Fix available6.8 Medium
- wordpress lanoba social plugin** DISPUTED ** Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the...CVE-2011-5182Public exploitDisputed4.3 Medium
- wordpresswp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not...CVE-2012-4422Fix available3.5 Low
- wordpressThe create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does...CVE-2012-4421Fix available4.0 Medium
- wordpressThe XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly...CVE-2010-5106Fix available6.5 Medium
- wordpress alert before you postCross-site scripting (XSS) vulnerability in post_alert.php in Alert Before Your Post plugin,...CVE-2011-5107Public exploit4.3 Medium
- mark jaquith bad behavior, wordpress +1 moreMultiple cross-site scripting (XSS) vulnerabilities in bad-behavior-wordpress-admin.php in the...CVE-2012-42714.3 Medium
- wordpressWordPress before 3.4.1 does not properly restrict access to post contents such as private or...CVE-2012-3385Fix available5.0 Medium
- wordpressCross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1...CVE-2012-3384Fix available6.8 Medium
- wordpressThe map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when...CVE-2012-3383Fix available2.6 Low
- wordpress plugin newsletter pluginDirectory traversal vulnerability in preview.php in the Plugin Newsletter plugin 1.5 for...CVE-2012-3588Public exploitEPSS 10.4%5.0 Medium
- wordpress fcchat widgetUnrestricted file upload vulnerability in html/Upload.php in the FCChat Widget plugin 2.2.13.1...CVE-2012-3578Public exploit6.8 Medium
- wordpress wassup pluginCross-site scripting (XSS) vulnerability in wassup.php in the WassUp plugin before 1.8.3.1 for...CVE-2012-26334.3 Medium
- wordpressThe make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not...CVE-2011-4957Fix available5.0 Medium
- wordpressCross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to...CVE-2011-4956Fix available4.3 Medium
- wordpress** DISPUTED ** The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and...CVE-2012-1936Public exploitDisputed6.8 Medium
- wordpresswp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier...CVE-2012-2404Fix available4.3 Medium
- wordpresswp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside...CVE-2012-2403Fix available4.3 Medium
- wordpresswp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to...CVE-2012-2402Fix available5.5 Medium
- moxiecode plupload, wordpress +1 morePlupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other...CVE-2012-2401Fix available5.0 Medium
- wordpressUnspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown...CVE-2012-2400Fix available10.0 High
- wordpressCross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as...CVE-2012-2399Fix available10.0 High
- Show moreLoading…