Skip to content

Browse Docs Sources Guide

Search/Get API key

Every CVE
Vendors
Wordpress

Wordpress vulnerabilities

Products

Wordpress362
Buddypress17
Wordpress-develop17
Mu10
Adserve3
Core3
Sniplets Plugin3
Blix2
Geo Controller2
Math Comment Spam Protection Plugin2
Max Addons Pro For Bricks2
Pay-with-tweet2
Royal-elementor-addons2
Wassup Plugin2

Newest

Known exploitedIn KEVPublic exploitFix available

wordpressWordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier...CVE-2012-6707Fix available7.5 HighOctober 19, 2017
wordpressWordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows...CVE-2016-9263Fix available4.7 MediumOctober 12, 2017
wordpress, debian linux +1 moreWordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous...CVE-2017-14990Fix available6.5 MediumOctober 2, 2017
wordpressBefore version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in...CVE-2017-14726Fix available6.1 MediumSeptember 23, 2017
wordpressBefore version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag...CVE-2017-14725Fix available5.4 MediumSeptember 23, 2017
wordpressBefore version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.CVE-2017-14724Fix available6.1 MediumSeptember 23, 2017
wordpressBefore version 4.8.2, WordPress mishandled % characters and additional placeholder values in ...CVE-2017-14723Fix available9.8 CriticalSeptember 23, 2017
wordpressBefore version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component...CVE-2017-14722Fix available7.5 HighSeptember 23, 2017
wordpressBefore version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted...CVE-2017-14721Fix available6.1 MediumSeptember 23, 2017
wordpressBefore version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view...CVE-2017-14720Fix available6.1 MediumSeptember 23, 2017
wordpressBefore version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip...CVE-2017-14719Public exploitFix availableEPSS 12.4%7.5 HighSeptember 23, 2017
wordpressBefore version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link...CVE-2017-14718Fix available6.1 MediumSeptember 23, 2017
wordpress, debian linux +1 moreIn WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading...CVE-2017-9066Fix available8.6 HighMay 18, 2017
wordpress, debian linux +1 moreIn WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC...CVE-2017-9065Fix available7.5 HighMay 18, 2017
wordpress, debian linux +1 moreIn WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the...CVE-2017-9064Fix available8.8 HighMay 18, 2017
wordpress, debian linux +1 moreIn WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer...CVE-2017-9063Fix available6.1 MediumMay 18, 2017
wordpress, debian linux +1 moreIn WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.CVE-2017-9062Fix available8.6 HighMay 18, 2017
wordpress, debian linux +1 moreIn WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to...CVE-2017-9061Fix available6.1 MediumMay 18, 2017
wordpressWordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which...CVE-2017-8295Public exploitFix availableEPSS 26.7%5.9 MediumMay 4, 2017
wordpressThe register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php...CVE-2017-1001000Fix availableEPSS 84.9%7.5 HighApril 3, 2017
wordpressIn WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin...CVE-2017-6819Fix available6.5 MediumMarch 12, 2017
wordpressIn WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via...CVE-2017-6818Fix available6.1 MediumMarch 12, 2017
wordpress, debian linux +1 moreIn WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting ...CVE-2017-6817Fix available5.4 MediumMarch 12, 2017
wordpress, debian linux +1 moreIn WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by...CVE-2017-6816Fix available4.9 MediumMarch 12, 2017
wordpress, debian linux +1 moreIn WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL...CVE-2017-6815Fix available6.1 MediumMarch 12, 2017
wordpress, debian linux +1 moreIn WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File...CVE-2017-6814Fix available5.4 MediumMarch 12, 2017
wordpress, debian linux +1 moreCross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in...CVE-2017-5612Fix available6.1 MediumJanuary 30, 2017
wordpress, debian linux, oracle data integrator +2 moreSQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7...CVE-2017-5611Fix availableEPSS 10.2%9.8 CriticalJanuary 30, 2017
wordpress, debian linux +1 morewp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not...CVE-2017-5610Fix available5.3 MediumJanuary 30, 2017
wordpressCross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin...CVE-2016-6897Public exploitFix availableEPSS 28.8%6.5 MediumJanuary 18, 2017
wordpressDirectory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax...CVE-2016-6896Public exploitFix availableEPSS 38.1%7.1 HighJanuary 18, 2017
wordpressThe wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6...CVE-2016-10148Fix available4.3 MediumJanuary 18, 2017
wordpresswp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not...CVE-2017-5493Fix available7.5 HighJanuary 15, 2017
wordpressCross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature...CVE-2017-5492Fix available8.8 HighJanuary 15, 2017
wordpresswp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting...CVE-2017-5491Fix available5.3 MediumJanuary 15, 2017
wordpressCross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes...CVE-2017-5490Fix available6.1 MediumJanuary 15, 2017
wordpressCross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers...CVE-2017-5489Fix available8.8 HighJanuary 15, 2017
wordpressMultiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress...CVE-2017-5488Fix available6.1 MediumJanuary 15, 2017
wordpresswp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation...CVE-2017-5487Public exploitFix availableEPSS 87.3%5.3 MediumJanuary 15, 2017
phpmailer project phpmailer, joomla joomla\!, wordpress +2 moreRemote code execution in PHPMailerCVE-2016-10045Public exploitFix availableEPSS 97.7%9.8 CriticalDecember 30, 2016
php phpmailer, joomla joomla\!, wordpress +2 moreRemote code execution in PHPMailerCVE-2016-10033In KEVPublic exploitFix availableEPSS 99.7%9.8 CriticalDecember 30, 2016
wordpressDirectory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class...CVE-2016-7169Fix available6.3 MediumSeptember 22, 2016
wordpressCross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes...CVE-2016-7168Fix available4.8 MediumSeptember 22, 2016
wordpressCross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp...CVE-2016-6635Fix available8.8 HighAugust 7, 2016
wordpressCross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5...CVE-2016-6634Fix available6.1 MediumAugust 7, 2016
wordpress, debian linux +1 moreWordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining...CVE-2016-4029Fix available8.6 HighAugust 7, 2016
wordpressWordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection...CVE-2016-5839Fix available7.5 HighJune 29, 2016
wordpressWordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by...CVE-2016-5838Fix available7.5 HighJune 29, 2016
wordpressWordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove...CVE-2016-5837Fix available7.5 HighJune 29, 2016
wordpressThe oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a...CVE-2016-5836Fix available7.5 HighJune 29, 2016
Show moreLoading…

Docs Sources Guide Browse Privacy Terms

esc

PagesAll vulnerabilities Browse Docs Sources Guide Get API key

MoveEnter Open