Wordpress-develop (Wordpress) - vulnerabilities (CVEs)

17 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2024-04-04. Vendor: Wordpress.

CVEs of Wordpress-develop

• CVE-2024-31210 - CVSS 8.8 (high), 2024-04-04: WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an…
• CVE-2024-31211 - CVSS 9.8 (critical), 2024-04-04: WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its…
• CVE-2022-21662 - CVSS 8 (high), 2022-01-06: WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like…
• CVE-2022-21664 - CVSS 8.8 (high), 2022-01-06: WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of…
• CVE-2022-21663 - CVSS 7.2 (high), 2022-01-06: WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role…
• CVE-2022-21661 - CVSS 8 (high), 2022-01-06: WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query,…
• CVE-2021-39202 - CVSS 7.6 (high), 2021-09-09: WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets…
• CVE-2021-39201 - CVSS 7.6 (high), 2021-09-09: WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an…
• CVE-2021-39200 - CVSS 5.3 (medium), 2021-09-09: WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of…
• CVE-2021-39203 - CVSS 6.8 (medium), 2021-09-09: WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated…
• CVE-2021-29450 - CVSS 6.5 (medium), 2021-04-15: Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This…
• CVE-2021-29447 - CVSS 7.1 (high), 2021-04-15: Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE…
• CVE-2020-4048 - CVSS 5.7 (medium), 2020-06-12: In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to…
• CVE-2020-4047 - CVSS 6.8 (medium), 2020-06-12: In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment…
• CVE-2020-4050 - CVSS 3.5 (low), 2020-06-12: In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an…
• CVE-2020-4046 - CVSS 5.4 (medium), 2020-06-12: In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered…
• CVE-2020-4049 - CVSS 2.4 (low), 2020-06-12: In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in…