Skip to contentWordpress vulnerabilities
Newest
- wordpress, debian linux +1 morePassword reset links invalidation issue in WordPressCVE-2020-11027Public exploitFix availableEPSS 13.6%6.1 Medium
- awesomemotive duplicator, wordpress snap creek duplicator plugin +1 moreThe Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1)...CVE-2020-11738In KEVPublic exploitEPSS 97.8%7.5 High
- buddypressPrivate data exposure via REST API in BuddyPressCVE-2020-5244Fix available8.0 High
- wordpress, debian linux +1 morewp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon...CVE-2019-20041Fix available9.8 Critical
- wordpress, debian linux +1 moreWordPress before 5.3.1 allowed an attacker to create a cross-site scripting attack (XSS) in well...CVE-2019-20042Fix available6.1 Medium
- wordpress, debian linux +1 moreWordPress before 5.3.1 allowed an unauthenticated user to make a post sticky through the REST API...CVE-2019-20043Fix available4.3 Medium
- wordpress, debian linux +1 moreStored cross-site scripting (XSS) in WordPress block editorCVE-2019-16781Fix available5.8 Medium
- wordpress, debian linux +1 moreStored cross-site scripting (XSS) in WordPress block editorCVE-2019-16780Fix available5.8 Medium
- wordpress, debian linux +1 moreIn WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the...CVE-2019-17671Public exploitFix availableEPSS 36.5%5.3 Medium
- wordpress, debian linux +1 moreWordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE...CVE-2019-17672Fix available6.1 Medium
- wordpress, debian linux +1 moreWordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because...CVE-2019-17673Fix available7.5 High
- wordpress, debian linux +1 moreWordPress before 5.2.4 does not properly consider type confusion during validation of the referer...CVE-2019-17675Fix available8.8 High
- wordpress, debian linux +1 moreWordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer.CVE-2019-17674Fix available5.4 Medium
- wordpress, debian linux +1 moreWordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL...CVE-2019-17669Fix available9.8 Critical
- wordpress, debian linux +1 moreWordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows...CVE-2019-17670Fix available9.8 Critical
- wordpress, debian linux +1 moreWordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.CVE-2019-16217Fix available6.1 Medium
- wordpress, debian linux +1 moreWordPress before 5.2.3 allows XSS in shortcode previews.CVE-2019-16219Fix available6.1 Medium
- wordpress, debian linux +1 moreWordPress before 5.2.3 allows reflected XSS in the dashboard.CVE-2019-16221Fix available6.1 Medium
- wordpress, debian linux +1 moreWordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp...CVE-2019-16222Fix available6.1 Medium
- wordpress, debian linux +1 moreWordPress before 5.2.3 allows XSS in post previews by authenticated users.CVE-2019-16223Public exploitFix available5.4 Medium
- wordpress, debian linux +1 moreIn WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp...CVE-2019-16220Fix available6.1 Medium
- wordpress, debian linux +1 moreWordPress before 5.2.3 allows XSS in stored comments.CVE-2019-16218Fix available6.1 Medium
- wordpressWordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain...CVE-2017-65145.3 Medium
- warfareplugins social warfare, social warfare pro, wordpress social warfare plugin +2 moreThe social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post...CVE-2019-9978In KEVPublic exploitEPSS 72.9%6.1 Medium
- wordpressWordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution...CVE-2019-9787Public exploitFix availableEPSS 38.6%8.8 High
- wordpressWordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges...CVE-2019-8943Public exploitEPSS 92.0%6.5 Medium
- wordpress, debian linux +1 moreWordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an...CVE-2019-8942Public exploitFix availableEPSS 81.7%8.8 High
- wordpress, debian linux +1 moreIn WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by...CVE-2018-20153Fix available5.4 Medium
- wordpress, debian linux +1 moreIn WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on...CVE-2018-20152Fix available6.5 Medium
- wordpress, debian linux +1 moreIn WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a...CVE-2018-20151Fix available7.5 High
- wordpress, debian linux +1 moreIn WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use...CVE-2018-20150Fix available6.1 Medium
- wordpress, debian linux +1 moreIn WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors...CVE-2018-20149Fix available5.4 Medium
- wordpress, debian linux +1 moreIn WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection...CVE-2018-20148Public exploitFix availableEPSS 26.8%9.8 Critical
- wordpress, debian linux +1 moreIn WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended...CVE-2018-20147Fix available6.5 Medium
- phpmailer project phpmailer, debian linux, fedoraproject fedora +1 more +3 morePhar object injection in PHPMailerCVE-2018-19296Fix available8.8 High
- wordpressWordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail...CVE-2018-10007738.8 High
- wordpressWordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing...CVE-2017-1000600Fix available8.8 High
- wordpressIn WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This...CVE-2018-14028EPSS 15.2%7.2 High
- wordpress, debian linux +1 moreWordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory...CVE-2018-12895Public exploitFix availableEPSS 62.2%8.8 High
- wordpress, debian linux +1 moreBefore WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and...CVE-2018-10102Fix available6.1 Medium
- wordpress, debian linux +1 moreBefore WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the...CVE-2018-10101Fix available6.1 Medium
- wordpress, debian linux +1 moreBefore WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if...CVE-2018-10100Fix available6.1 Medium
- wordpressWordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via...CVE-2014-64128.1 High
- wordpressIn WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource...CVE-2018-6389Public exploitEPSS 72.7%7.5 High
- wordpressWordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js...CVE-2018-5776Fix available6.1 Medium
- wordpress, debian linux +1 morewp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and...CVE-2017-17094Fix available5.4 Medium
- wordpress, debian linux +1 morewp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang...CVE-2017-17093Fix available5.4 Medium
- wordpress, debian linux +1 morewp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html...CVE-2017-17092Fix available5.4 Medium
- wordpresswp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be...CVE-2017-17091Fix available8.8 High
- wordpressWordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and...CVE-2017-16510Fix available9.8 Critical
- Show moreLoading…