Wordpress (Wordpress) - vulnerabilities (CVEs)

357 CVEs, 0 in the last 30 days, 1324 known versions, newest CVE from 2026-09-22. Vendor: Wordpress.

CVEs of Wordpress

CVE-2026-87902 - CVSS 8.1 (high), 2026-09-22: An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme…
CVE-2026-65640 - CVSS 8.8 (high), 2026-08-17: WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: *…
CVE-2026-64638 - CVSS 8.9 (high), 2026-08-07: WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an…
CVE-2026-60137 - CVSS 5.9 (medium), 2026-07-17: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could…
CVE-2026-63030 - CVSS 9.8 (critical), 2026-07-17: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in…
CVE-2025-58674 - CVSS 5.9 (medium), 2025-09-23: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows Stored XSS. WordPress core security…
CVE-2025-58246 - CVSS 4.3 (medium), 2025-09-23: Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is…
CVE-2025-54352 - CVSS 3.7 (low), 2025-07-21: WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not…
CVE-2022-4973 - CVSS 5.4 (medium), 2024-10-16: WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the…
CVE-2024-4439 - CVSS 7.2 (high), 2024-05-03: WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient…
CVE-2024-31210 - CVSS 8.8 (high), 2024-04-04: WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an…
CVE-2024-31211 - CVSS 9.8 (critical), 2024-04-04: WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its…
CVE-2023-5561 - CVSS 5.3 (medium), 2023-10-16: WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of…
CVE-2023-39999 - CVSS 4.3 (medium), 2023-10-13: Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0…
CVE-2023-38000 - CVSS 6.5 (medium), 2023-10-13: Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from…
CVE-2023-2745 - CVSS 6.1 (medium), 2023-05-17: WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers…
CVE-2023-22622 - CVSS 5.3 (medium), 2023-01-05: WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code…
CVE-2022-3590 - CVSS 5.9 (medium), 2022-12-14: WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP…
CVE-2022-43500 - CVSS 6.1 (medium), 2022-12-05: Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer…
CVE-2022-43497 - CVSS 6.1 (medium), 2022-12-05: Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer…
CVE-2022-43504 - CVSS 5.3 (medium), 2022-12-05: Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user…
CVE-2011-1762 - CVSS 6.5 (medium), 2022-04-18: A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user…
CVE-2022-21664 - CVSS 8.8 (high), 2022-01-06: WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of…
CVE-2022-21663 - CVSS 7.2 (high), 2022-01-06: WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role…
CVE-2022-21662 - CVSS 8 (high), 2022-01-06: WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like…
CVE-2022-21661 - CVSS 8 (high), 2022-01-06: WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query,…
CVE-2021-44223 - CVSS 9.8 (critical), 2021-11-25: WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain…
CVE-2021-39201 - CVSS 7.6 (high), 2021-09-09: WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an…
CVE-2021-39200 - CVSS 5.3 (medium), 2021-09-09: WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of…
CVE-2021-39203 - CVSS 6.8 (medium), 2021-09-09: WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated…
CVE-2021-39202 - CVSS 7.6 (high), 2021-09-09: WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets…
CVE-2020-36326 - CVSS 9.8 (critical), 2021-04-28: PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to…
CVE-2021-29450 - CVSS 6.5 (medium), 2021-04-15: Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This…
CVE-2021-29447 - CVSS 7.1 (high), 2021-04-15: Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE…
CVE-2020-28039 - CVSS 9.1 (critical), 2020-11-02: is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key…
CVE-2020-28038 - CVSS 6.1 (medium), 2020-11-02: WordPress before 5.5.2 allows stored XSS via post slugs.
CVE-2020-28040 - CVSS 4.3 (medium), 2020-11-02: WordPress before 5.5.2 allows CSRF attacks that change a theme's background image.
CVE-2020-28036 - CVSS 9.8 (critical), 2020-11-02: wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.
CVE-2020-28032 - CVSS 9.8 (critical), 2020-11-02: WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.
CVE-2020-28035 - CVSS 9.8 (critical), 2020-11-02: WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.
CVE-2020-28034 - CVSS 6.1 (medium), 2020-11-02: WordPress before 5.5.2 allows XSS associated with global variables.
CVE-2020-28037 - CVSS 9.8 (critical), 2020-11-02: is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an…
CVE-2020-28033 - CVSS 7.5 (high), 2020-11-02: WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.
CVE-2020-25286 - CVSS 5.3 (medium), 2020-09-13: In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or…
CVE-2020-4046 - CVSS 5.4 (medium), 2020-06-12: In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered…
CVE-2020-4049 - CVSS 2.4 (low), 2020-06-12: In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in…
CVE-2020-4048 - CVSS 5.7 (medium), 2020-06-12: In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to…
CVE-2020-4047 - CVSS 6.8 (medium), 2020-06-12: In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment…
CVE-2020-4050 - CVSS 3.5 (low), 2020-06-12: In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an…
CVE-2020-11026 - CVSS 8.7 (high), 2020-04-30: In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the…
CVE-2020-11029 - CVSS 6.1 (medium), 2020-04-30: In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS)…
CVE-2020-11028 - CVSS 7.5 (high), 2020-04-30: In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of…
CVE-2020-11027 - CVSS 8.1 (high), 2020-04-30: In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the…
CVE-2020-11030 - CVSS 6.4 (medium), 2020-04-30: In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor.…
CVE-2020-11025 - CVSS 5.8 (medium), 2020-04-30: In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed.…
CVE-2019-20041 - CVSS 9.8 (critical), 2019-12-27: wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input…
CVE-2019-20043 - CVSS 4.3 (medium), 2019-12-27: In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a…
CVE-2019-20042 - CVSS 6.1 (medium), 2019-12-27: In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site…
CVE-2019-16781 - CVSS 5.8 (medium), 2019-12-26: In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed…
CVE-2019-16780 - CVSS 5.8 (medium), 2019-12-26: WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within…
CVE-2019-17673 - CVSS 7.5 (high), 2019-10-17: WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.
CVE-2019-17672 - CVSS 6.1 (medium), 2019-10-17: WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.
CVE-2019-17675 - CVSS 8.8 (high), 2019-10-17: WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.
CVE-2019-17674 - CVSS 5.4 (medium), 2019-10-17: WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer.
CVE-2019-17669 - CVSS 9.8 (critical), 2019-10-17: WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a…
CVE-2019-17671 - CVSS 5.3 (medium), 2019-10-17: In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.
CVE-2019-17670 - CVSS 9.8 (critical), 2019-10-17: WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.
CVE-2019-16221 - CVSS 6.1 (medium), 2019-09-11: WordPress before 5.2.3 allows reflected XSS in the dashboard.
CVE-2019-16223 - CVSS 5.4 (medium), 2019-09-11: WordPress before 5.2.3 allows XSS in post previews by authenticated users.
CVE-2019-16222 - CVSS 6.1 (medium), 2019-09-11: WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS)…
CVE-2019-16218 - CVSS 6.1 (medium), 2019-09-11: WordPress before 5.2.3 allows XSS in stored comments.
CVE-2019-16217 - CVSS 6.1 (medium), 2019-09-11: WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.
CVE-2019-16220 - CVSS 6.1 (medium), 2019-09-11: In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a…
CVE-2019-16219 - CVSS 6.1 (medium), 2019-09-11: WordPress before 5.2.3 allows XSS in shortcode previews.
CVE-2017-6514 - CVSS 5.3 (medium), 2019-05-22: WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a…
CVE-2019-9787 - CVSS 8.8 (high), 2019-03-14: WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This…
CVE-2019-8943 - CVSS 6.5 (medium), 2019-02-20: WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary…
CVE-2019-8942 - CVSS 8.8 (high), 2019-02-20: WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string,…
CVE-2018-20153 - CVSS 5.4 (medium), 2018-12-14: In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.
CVE-2018-20149 - CVSS 5.4 (medium), 2018-12-14: In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type…
CVE-2018-20152 - CVSS 6.5 (medium), 2018-12-14: In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.
CVE-2018-20148 - CVSS 9.8 (critical), 2018-12-14: In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call.…
CVE-2018-20151 - CVSS 7.5 (high), 2018-12-14: In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were…
CVE-2018-20147 - CVSS 6.5 (medium), 2018-12-14: In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.
CVE-2018-20150 - CVSS 6.1 (medium), 2018-12-14: In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
CVE-2018-19296 - CVSS 8.8 (high), 2018-11-16: PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.
CVE-2018-1000773 - CVSS 8.8 (high), 2018-09-06: WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to…
CVE-2017-1000600 - CVSS 8.8 (high), 2018-09-06: WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears…
CVE-2018-14028 - CVSS 7.2 (high), 2018-08-10: In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is…
CVE-2018-12895 - CVSS 8.8 (high), 2018-06-26: WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is…
CVE-2018-10101 - CVSS 6.1 (medium), 2018-04-16: Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
CVE-2018-10100 - CVSS 6.1 (medium), 2018-04-16: Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
CVE-2018-10102 - CVSS 6.1 (medium), 2018-04-16: Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.
CVE-2014-6412 - CVSS 8.1 (high), 2018-04-12: WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
CVE-2018-6389 - CVSS 7.5 (high), 2018-02-06: In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files…
CVE-2018-5776 - CVSS 6.1 (medium), 2018-01-18: WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).
CVE-2017-17092 - CVSS 5.4 (medium), 2017-12-02: wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote…
CVE-2017-17091 - CVSS 8.8 (high), 2017-12-02: wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote…
CVE-2017-17094 - CVSS 5.4 (medium), 2017-12-02: wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS…
CVE-2017-17093 - CVSS 5.4 (medium), 2017-12-02: wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to…