Wordpress (Wordpress Foundation) - vulnerabilities (CVEs)

7 CVEs, 1 in the last 30 days, 2 known versions, newest CVE from 2026-10-22. Vendor: Wordpress Foundation.

CVEs of Wordpress

• CVE-2026-114570 - CVSS 4.9 (medium), 2026-10-22: WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user…
• CVE-2026-3906 - CVSS 4.3 (medium), 2026-03-11: WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in…
• CVE-2022-4973 - CVSS 5.4 (medium), 2024-10-16: WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the…
• CVE-2024-6307 - CVSS 6.4 (medium), 2024-06-25: WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and…
• CVE-2024-4439 - CVSS 7.2 (high), 2024-05-03: WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient…
• CVE-2023-5692 - CVSS 5.3 (medium), 2024-04-05: WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can…
• CVE-2023-2745 - CVSS 6.1 (medium), 2023-05-17: WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers…