Skip to contentWordpress vulnerabilities
Newest
- wordpressWordPress < 6.3.2 - Unauthenticated Post Author Email DisclosureCVE-2023-5561Public exploitFix available5.3 Medium
- wordpress, fedoraproject fedora +1 moreWordPress < 6.3.2 is vulnerable to Broken Access ControlCVE-2023-39999Fix available4.3 Medium
- gutenberg team gutenberg, wordpress +1 moreAuth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links BlockCVE-2023-38000Fix available6.5 Medium
- wordpress blogger importerBlogger Importer Plugin blogger-importer.php restart cross-site request forgeryCVE-2013-100274.3 Medium
- wordpress performance labWordPress Performance Lab Plugin <= 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2022-471744.3 Medium
- the wordpress.org community health check & troubleshooting, wordpress health check \& troubleshooting +1 moreWordPress Health Check & Troubleshooting Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2022-471614.3 Medium
- wordpressWordPress Core < 6.2.1 - Directory TraversalCVE-2023-2745Public exploitFix availableEPSS 79.7%5.4 Medium
- dd32 debug bar plugin, wordpress debug bar +1 moredd32 Debug Bar Plugin class-debug-bar-queries.php render cross site scriptingCVE-2013-100213.5 Low
- wordpressWordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and...CVE-2023-22622Public exploitFix available5.3 Medium
- wordpressWP <= 6.1.1 - Unauthenticated Blind SSRF via DNS RebindingCVE-2022-3590Public exploitFix available5.9 Medium
- wordpressImproper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote...CVE-2022-43504Fix available5.3 Medium
- wordpressCross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote...CVE-2022-43500Fix available6.1 Medium
- wordpressCross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote...CVE-2022-43497Fix available6.1 Medium
- wordpressA flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking...CVE-2011-1762Fix available6.5 Medium
- wordpress, debian linux, wordpress wordpress-develop +2 moreStored XSS in WordPressCVE-2022-21662Fix availableEPSS 64.5%8.0 High
- wordpress, debian linux, fedoraproject fedora +1 more +3 moreAuthenticated Object Injection in Multisites in WordPressCVE-2022-21663Fix available6.6 Medium
- wordpress, debian linux, fedoraproject fedora +1 more +3 moreSQL injection in WordPressCVE-2022-21664Fix available7.4 High
- wordpress, debian linux, fedoraproject fedora +1 more +3 moreSQL injection in WordPressCVE-2022-21661Public exploitFix availableEPSS 97.8%8.0 High
- wordpressWordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for...CVE-2021-44223Fix availableEPSS 29.0%8.1 High
- cusmin absolutely glamorous custom admin, agca - absolutely glamorous custom admin (wordpress plugin) +1 moreWordPress Absolutely Glamorous Custom Admin plugin <= 6.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityCVE-2021-368236.6 Medium
- wordpress, wordpress wordpress-develop +1 morePrivate data disclosure/privilege escalation through the block editor in WordpressCVE-2021-392036.8 Medium
- wordpress, wordpress wordpress-develop +1 moreWordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widgetCVE-2021-392027.6 High
- wordpress, debian linux, wordpress wordpress-develop +2 moreAuthenticated cross-site scripting (XSS) in WordPress editorCVE-2021-39201Fix available7.6 High
- wordpress, debian linux, wordpress wordpress-develop +2 moreInformation Disclosure in wp_die() via JSONP in wordpressCVE-2021-39200Fix available5.3 Medium
- phpmailer project phpmailer, wordpress +1 moreObject injection in PHPMailer/PHPMailerCVE-2020-36326Fix available9.8 Critical
- psf requestsInsecure Deserialization of untrusted data in rmccue/requestsCVE-2021-29476Fix available9.8 Critical
- wordpress, debian linux, wordpress wordpress-develop +2 moreWordPress Authenticated disclosure of password-protected posts and pagesCVE-2021-29450Fix available6.5 Medium
- wordpress, debian linux, wordpress wordpress-develop +2 moreWordPress Authenticated XXE attack when installation is running PHP 8CVE-2021-29447Public exploitFix availableEPSS 85.7%7.1 High
- buddypressBuddyPress privilege escalation via REST APICVE-2021-21389Public exploitFix availableEPSS 14.8%8.1 High
- wordpress, debian linux, fedoraproject fedora +2 moreWordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility...CVE-2020-28032Public exploitFix availableEPSS 15.7%9.8 Critical
- wordpress, debian linux, fedoraproject fedora +2 moreWordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as...CVE-2020-28033Fix available7.5 High
- wordpress, debian linux, fedoraproject fedora +2 moreWordPress before 5.5.2 allows XSS associated with global variables.CVE-2020-28034Fix available6.1 Medium
- wordpress, debian linux, fedoraproject fedora +2 morewp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain...CVE-2020-28036Fix available9.8 Critical
- wordpress, debian linux, fedoraproject fedora +2 moreis_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines...CVE-2020-28037Fix available9.8 Critical
- wordpress, debian linux, fedoraproject fedora +2 moreWordPress before 5.5.2 allows stored XSS via post slugs.CVE-2020-28038Fix available6.1 Medium
- wordpress, canonical ubuntu linux, debian linux +2 moreWordPress before 5.5.2 allows CSRF attacks that change a theme's background image.CVE-2020-28040Fix available4.3 Medium
- wordpress, canonical ubuntu linux, debian linux +2 moreis_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file...CVE-2020-28039Fix available9.1 Critical
- wordpress, debian linux, fedoraproject fedora +2 moreWordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.CVE-2020-28035Fix available9.8 Critical
- filemanagerpro file manager, wordpress file manager plugin +1 moreThe File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to...CVE-2020-25213In KEVPublic exploitEPSS 97.3%10.0 Critical
- wordpressIn wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could...CVE-2020-25286Fix available5.3 Medium
- wordpress, debian linux, fedoraproject fedora +1 more +3 moreAuthenticated XSS via media attachment page in WordPressCVE-2020-4047Fix available6.8 Medium
- wordpress, debian linux, fedoraproject fedora +1 more +3 moreOpen redirect in wp_validate_redirect() in WordPressCVE-2020-4048Fix available5.7 Medium
- wordpress, debian linux, fedoraproject fedora +1 more +3 moreAuthenticated self-XSS via theme uploads in WordPressCVE-2020-4049Fix available2.4 Low
- wordpress, debian linux, fedoraproject fedora +1 more +3 moreset-screen-option filter misuse by plugins leading to privilege escalation in WordPressCVE-2020-4050Fix available3.5 Low
- wordpress, debian linux, fedoraproject fedora +1 more +3 moreAuthenticated XSS through embed block in WordPressCVE-2020-4046Fix available5.4 Medium
- wordpress, debian linux +1 moreSpecially crafted filenames in WordPress leading to XSSCVE-2020-11026Fix available8.7 High
- wordpress, debian linux +1 moreUnauthenticated disclosure of certain private posts in WordPressCVE-2020-11028Fix available5.8 Medium
- wordpress, debian linux +1 moreCross-site scripting in stats method (object cache) in WordPressCVE-2020-11029Fix available5.8 Medium
- wordpress, debian linux +1 moreCross-site scripting (XSS) in Search block in WordPressCVE-2020-11030Fix available6.4 Medium
- wordpress, debian linux +1 moreAuthenticated cross-site scripting (XSS) in WordPress CustomizerCVE-2020-11025Fix available5.8 Medium
- Show moreLoading…