Skip to contentWordpress vulnerabilities
Newest
- wordpressWordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information...CVE-2016-5835Fix available7.5 High
- wordpressCross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes...CVE-2016-5834Fix available6.1 Medium
- wordpressCross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class...CVE-2016-5833Fix available6.1 Medium
- wordpressThe customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection...CVE-2016-5832Fix available7.5 High
- mediaelementjs mediaelement.js, wordpress +1 moreMediaElement Vulnerable to Reflected XSSCVE-2016-4567Fix available6.1 Medium
- plupload, wordpress +1 moreCross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used...CVE-2016-4566Fix available6.1 Medium
- wordpressCross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2...CVE-2015-8834Fix available6.1 Medium
- wordpressThe wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote...CVE-2016-2222Fix available8.6 High
- wordpressOpen redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in...CVE-2016-2221Fix available7.4 High
- wordpressMultiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in...CVE-2016-1564Fix available6.1 Medium
- wordpressCross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows...CVE-2015-7989Fix available5.4 Medium
- wordpressThe mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in...CVE-2015-5715Fix available4.3 Medium
- wordpressCross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to...CVE-2015-5714Fix available6.1 Medium
- wordpressCross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp...CVE-2015-5734Fix available4.3 Medium
- wordpressCross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp...CVE-2015-5733Fix available4.3 Medium
- wordpressCross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in...CVE-2015-5732Fix available4.3 Medium
- wordpressCross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4...CVE-2015-5731Fix available6.8 Medium
- wordpressThe sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress...CVE-2015-5730Fix available5.0 Medium
- wordpressSQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in...CVE-2015-2213Fix available7.5 High
- wordpress, debian linux +1 moreWordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote...CVE-2015-5623Fix available4.0 Medium
- wordpress, debian linux +1 moreCross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated...CVE-2015-5622Fix available3.5 Low
- wordpress, debian linux +1 moreCross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1...CVE-2015-3440Public exploitFix availableEPSS 16.8%4.3 Medium
- wordpress, debian linux +1 moreCross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf...CVE-2015-3439Fix available4.3 Medium
- wordpress, debian linux +1 moreMultiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used...CVE-2015-3438Fix available4.3 Medium
- wordpress, debian linux, mageia project mageia +2 morewp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4...CVE-2014-9039Fix available4.3 Medium
- wordpresswp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x...CVE-2014-9038Fix available6.4 Medium
- wordpress, debian linux, mageia project mageia +2 moreWordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow...CVE-2014-9037Fix available6.8 Medium
- wordpress, debian linux +1 moreCross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x...CVE-2014-9036Fix available4.3 Medium
- wordpress, debian linux +1 moreCross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3...CVE-2014-9035Fix available4.3 Medium
- wordpresswp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3,...CVE-2014-9034Public exploitFix availableEPSS 83.2%5.0 Medium
- wordpressCross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2,...CVE-2014-9033Fix available6.8 Medium
- wordpressCross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x...CVE-2014-9032Fix available4.3 Medium
- wordpressCross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3...CVE-2014-9031Fix available4.3 Medium
- wordpressPHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote...CVE-2003-15997.5 High
- wordpressSQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote...CVE-2003-1598Fix available7.5 High
- wordpresswp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before...CVE-2014-5203Fix available7.5 High
- drupal, wordpress, debian linux +2 moreThe Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33...CVE-2014-5266Fix availableEPSS 25.2%5.0 Medium
- drupal, wordpress, debian linux +2 moreThe Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33...CVE-2014-5265Fix available5.0 Medium
- wordpress, debian linux +1 moreCross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2,...CVE-2014-5240Fix available2.1 Low
- wordpresswp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation...CVE-2014-5205Fix available6.8 Medium
- wordpress, debian linux +1 morewp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different...CVE-2014-5204Fix available6.8 Medium
- wordpressThe wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3...CVE-2014-0166Public exploitFix available6.4 Medium
- wordpressWordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts...CVE-2014-0165Fix available4.0 Medium
- wordpresswp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly...CVE-2012-6635Fix available4.0 Medium
- wordpresswp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive...CVE-2012-6634Fix available6.4 Medium
- wordpressCross-site scripting (XSS) vulnerability in wp-includes/default-filters.php in WordPress before 3...CVE-2012-6633Fix available4.3 Medium
- wordpresswp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability...CVE-2011-5270Fix available4.0 Medium
- wordpressWordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site...CVE-2010-5297Fix available2.1 Low
- wordpresswp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used,...CVE-2010-5296Fix available4.9 Medium
- wordpressCross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might...CVE-2010-5295Fix available4.3 Medium
- Show moreLoading…