WO
CMS
WordPress
On CISA KEVExploited in the wild
370
CVEs
7
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 20High 48Medium 106Low 3
Watch
Add WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-5833 | 6.1 | Jun 29 | Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to… Affected: through 4.5.2 |
| CVE-2016-4567 | 6.1 | May 22 | Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject… Affected: through 4.5.1 |
| CVE-2016-4566 | 6.1 | May 22 | Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script… Affected: through 4.5.1 |
| CVE-2016-1564 | 6.1 | May 22 | Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a… Affected: through 4.4.0 |
| CVE-2015-8834 | 6.1 | May 22 | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that… Affected: through 4.2.1 |
| CVE-2015-5714 | 6.1 | May 22 | Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML… Affected: through 4.3.0 |
| CVE-2025-58674 | 5.9 | Sep 23 | WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability Affected: 6.8 through 6.8.2; 6.7 through 6.7.3; 6.6 through 6.6.3; 6.5 through 6.5.6; 6.4 through 6.4.6; 6.3 through 6.3.6; +16 more |
| CVE-2022-3590 | 5.9 | Dec 14 | WordPress is affected by an unauthenticated blind SSRF in the pingback feature Affected: 4.2 through 6.1.1; 4.1 |
| CVE-2017-8295 | 5.9 | May 4 | WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a… Affected: through 4.7.4 |
| CVE-2020-4048 | 5.7 | Jun 12 | In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect… Affected: 3.7 before 3.7.34; 3.8 before 3.8.34; 3.9 before 3.9.32; 4.0 before 4.0.31; 4.1 before 4.1.31; 4.2 before 4.2.28; +12 more |
| CVE-2022-4973 | 5.4 | Oct 16 | WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function Affected: through 3.6.1; 3.7 through 3.7.38; 3.8 through 3.8.38; 3.9 through 3.9.36; 4.0 through 4.0.35; 4.1 through 4.1.35; +19 more |
| CVE-2023-38000 | 5.4 | Oct 13 | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5,… Affected: 5.9 through 5.9.7; 6.0 through 6.0.5; 6.1 through 6.1.3; 6.2 through 6.2.2; 6.3 through 6.3.1 |
| CVE-2023-2745 | 5.4 | May 17 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter Affected: before 4.1.38; 4.2 before 4.2.35; 4.3 before 4.3.31; 4.4 before 4.4.30; 4.5 before 4.5.29; 4.6 before 4.6.26; +16 more |
| CVE-2022-21662 | 5.4 | Jan 6 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database Affected: before 5.8.3 |
| CVE-2021-39202 | 5.4 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database Affected: 5.8; 5.8 |
| CVE-2021-39201 | 5.4 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database Affected: 5.0 before 5.8 |
| CVE-2020-4046 | 5.4 | Jun 12 | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor Affected: 3.7 before 3.7.34; 3.8 before 3.8.34; 3.9 before 3.9.32; 4.0 before 4.0.31; 4.1 before 4.1.31; 4.2 before 4.2.28; +12 more |
| CVE-2020-11030 | 5.4 | Apr 30 | In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor Affected: before 5.4.1 |
| CVE-2020-11026 | 5.4 | Apr 30 | In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file Affected: 3.7 before 3.7.33; 3.8 before 3.8.33; 3.9 before 3.9.31; 4.0 before 4.0.30; 4.1 before 4.1.30; 4.2 before 4.2.27; +12 more |
| CVE-2020-11025 | 5.4 | Apr 30 | In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed Affected: 4.7 before 5.4.1 |
| CVE-2019-16781 | 5.4 | Dec 26 | In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard Affected: before 5.3.1 |
| CVE-2019-16780 | 5.4 | Dec 26 | WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard Affected: after 3.7 before 5.3.1; 3.7 |
| CVE-2019-17674 | 5.4 | Oct 17 | WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer Affected: before 5.2.4 |
| CVE-2019-16223 | 5.4 | Sep 11 | WordPress before 5.2.3 allows XSS in post previews by authenticated users Affected: before 5.2.3 |
| CVE-2018-20153 | 5.4 | Dec 14 | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS Affected: before 4.9.9; 5.0 before 5.0.1 |
| CVE-2018-20149 | 5.4 | Dec 14 | In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to… Affected: before 4.9.9; 5.0 before 5.0.1 |
| CVE-2017-17094 | 5.4 | Dec 2 | wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL Affected: before 4.9.1 |
| CVE-2017-17093 | 5.4 | Dec 2 | wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via… Affected: before 4.9.1 |
| CVE-2017-17092 | 5.4 | Dec 2 | wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS… Affected: before 4.9.1 |
| CVE-2017-14725 | 5.4 | Sep 23 | Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php Affected: through 4.8.1 |
| CVE-2017-6817 | 5.4 | Mar 12 | In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds Affected: through 4.7.2 |
| CVE-2017-6814 | 5.4 | Mar 12 | In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata Affected: through 4.7.2 |
| CVE-2015-7989 | 5.4 | May 22 | Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted… Affected: through 4.3.0 |
| CVE-2023-5561 | 5.3 | Oct 16 | WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have… Affected: 4.7 before 4.7.27; 4.8 before 4.8.23; 4.9 before 4.9.24; 5.0 before 5.0.20; 5.1 before 5.1.17; 5.2 before 5.2.19; +11 more |
| CVE-2023-22622 | 5.3 | Jan 5 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where… Affected: through 6.1.1 |
| CVE-2022-43504 | 5.3 | Dec 5 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using… Affected: before 3.7.40; 3.8 before 3.8.40; 3.9 before 3.9.39; 4.0 before 4.0.37; 4.1 before 4.1.37; 4.2 before 4.2.34; +18 more |
| CVE-2021-39200 | 5.3 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database Affected: 5.2 before 5.8.1 |
| CVE-2020-25286 | 5.3 | Sep 13 | In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public Affected: before 5.4.2 |
| CVE-2019-17671 | 5.3 | Oct 17 | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled Affected: before 5.2.4 |
| CVE-2017-6514 | 5.3 | May 22 | WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request,… Affected: 4.7.2 |
| CVE-2017-5610 | 5.3 | Jan 30 | wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows… Affected: through 4.7.1 |
| CVE-2017-5491 | 5.3 | Jan 15 | wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name Affected: through 4.7 |
| CVE-2017-5487 | 5.3 | Jan 15 | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors,… Affected: through 4.7 |
| CVE-2005-1688 | 5.3 | May 20 | Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, (2) wp-includes/, or (3) wp-admin/,… Affected: through 1.5 |
| CVE-2026-114570 | 4.9 | Oct 22 | WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit Affected: 4.7.0 through 4.7.33; 4.8.0 through 4.8.28; 4.9.0 through 4.9.29; 5.0.0 through 5.0.25; 5.1.0 through 5.1.22; 5.2.0 through 5.2.24; +18 more |
| CVE-2017-6816 | 4.9 | Mar 12 | In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality Affected: through 4.7.2 |
| CVE-2016-7168 | 4.8 | Jan 5 | Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject… Affected: through 4.6 |
| CVE-2016-9263 | 4.7 | Oct 12 | WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by… Affected: through 4.8.2 |
| CVE-2026-3906 | 4.3 | Mar 11 | WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API Affected: 6.9 through 6.9.1 |
| CVE-2025-58246 | 4.3 | Sep 23 | WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability Affected: 6.8 through 6.8.2; 6.7 through 6.7.3; 6.6 through 6.6.3; 6.5 through 6.5.6; 6.4 through 6.4.6; 6.3 through 6.3.6; +16 more |