WO
CMS
WordPress
On CISA KEVExploited in the wild
371
CVEs
7
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 20High 48Medium 107Low 3
Watch
Add WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-7989 | 5.4 | May 22 | Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted… Affected: through 4.3.0 |
| CVE-2023-5692 | 5.3 | Apr 5 | WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink Affected: through 6.4.3 |
| CVE-2023-5561 | 5.3 | Oct 16 | WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have… Affected: 4.7 before 4.7.27; 4.8 before 4.8.23; 4.9 before 4.9.24; 5.0 before 5.0.20; 5.1 before 5.1.17; 5.2 before 5.2.19; +11 more |
| CVE-2023-22622 | 5.3 | Jan 5 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where… Affected: through 6.1.1 |
| CVE-2022-43504 | 5.3 | Dec 5 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using… Affected: before 3.7.40; 3.8 before 3.8.40; 3.9 before 3.9.39; 4.0 before 4.0.37; 4.1 before 4.1.37; 4.2 before 4.2.34; +18 more |
| CVE-2021-39200 | 5.3 | Sep 9 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database Affected: 5.2 before 5.8.1 |
| CVE-2020-25286 | 5.3 | Sep 13 | In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public Affected: before 5.4.2 |
| CVE-2019-17671 | 5.3 | Oct 17 | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled Affected: before 5.2.4 |
| CVE-2017-6514 | 5.3 | May 22 | WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request,… Affected: 4.7.2 |
| CVE-2017-5610 | 5.3 | Jan 30 | wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows… Affected: through 4.7.1 |
| CVE-2017-5491 | 5.3 | Jan 15 | wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name Affected: through 4.7 |
| CVE-2017-5487 | 5.3 | Jan 15 | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors,… Affected: through 4.7 |
| CVE-2005-1688 | 5.3 | May 20 | Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/, (2) wp-includes/, or (3) wp-admin/,… Affected: through 1.5 |
| CVE-2026-114570 | 4.9 | Oct 22 | WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit Affected: 4.7.0 through 4.7.33; 4.8.0 through 4.8.28; 4.9.0 through 4.9.29; 5.0.0 through 5.0.25; 5.1.0 through 5.1.22; 5.2.0 through 5.2.24; +18 more |
| CVE-2017-6816 | 4.9 | Mar 12 | In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality Affected: through 4.7.2 |
| CVE-2016-7168 | 4.8 | Jan 5 | Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject… Affected: through 4.6 |
| CVE-2016-9263 | 4.7 | Oct 12 | WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by… Affected: through 4.8.2 |
| CVE-2026-3906 | 4.3 | Mar 11 | WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API Affected: 6.9 through 6.9.1 |
| CVE-2025-58246 | 4.3 | Sep 23 | WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability Affected: 6.8 through 6.8.2; 6.7 through 6.7.3; 6.6 through 6.6.3; 6.5 through 6.5.6; 6.4 through 6.4.6; 6.3 through 6.3.6; +16 more |
| CVE-2023-39999 | 4.3 | Oct 13 | WordPress < 6.3.2 is vulnerable to Broken Access Control Affected: 6.3 through 6.3.1; 6.2 through 6.2.2; 6.1 through 6.1.3; 6.0 through 6.0.5; 5.9 through 5.9.7; 5.8 through 5.8.7; +17 more |
| CVE-2021-29450 | 4.3 | Apr 15 | Wordpress is an open source CMS Affected: 4.7 before 5.7.1 |
| CVE-2020-28040 | 4.3 | Nov 2 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image Affected: before 5.5.2 |
| CVE-2019-20043 | 4.3 | Dec 27 | In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to… Affected: 3.7 before 5.3.1 |
| CVE-2016-10148 | 4.3 | Jan 18 | The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which… Affected: through 4.5.5 |
| CVE-2015-5715 | 4.3 | May 22 | The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access… Affected: through 4.3.0 |
| CVE-2025-54352 | 3.7 | Jul 21 | WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests Affected: 3.5 through 6.8.2 |
| CVE-2020-4050 | 3.1 | Jun 12 | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved Affected: 3.7 before 3.7.34; 3.8 before 3.8.34; 3.9 before 3.9.32; 4.0 before 4.0.31; 4.1 before 4.1.31; 4.2 before 4.2.28; +12 more |
| CVE-2020-4049 | 2.4 | Jun 12 | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes… Affected: 3.7 before 3.7.34; 3.8 before 3.8.34; 3.9 before 3.9.32; 4.0 before 4.0.31; 4.1 before 4.1.31; 4.2 before 4.2.28; +12 more |
| CVE-2015-5734 | – | Nov 9 | Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary… Affected: through 4.2.3 |
| CVE-2015-5733 | – | Nov 9 | Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject… Affected: through 4.2.3 |
| CVE-2015-5732 | – | Nov 9 | Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers… Affected: through 4.2.3 |
| CVE-2015-5731 | – | Nov 9 | Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests… Affected: through 4.2.3 |
| CVE-2015-5730 | – | Nov 9 | The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows… Affected: through 4.2.3 |
| CVE-2015-2213 | – | Nov 9 | SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands… Affected: through 4.2.3 |
| CVE-2015-3439 | – | Aug 5 | Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and… Affected: 3.9.0; 3.9.1; 3.9.2; 3.9.3; 4.0; 4.0.1; +2 more |
| CVE-2015-3438 | – | Aug 5 | Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or… Affected: through 4.1.1 |
| CVE-2015-5623 | – | Aug 3 | WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by… Affected: through 4.2.2 |
| CVE-2015-5622 | – | Aug 3 | Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor… Affected: through 4.2.2 |
| CVE-2015-3440 | – | Aug 3 | Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that… Affected: through 4.2 |
| CVE-2014-9039 | – | Nov 25 | wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an… Affected: through 3.7.4; 3.8; 3.8.1; 3.8.2; 3.8.3; 3.8.4; +4 more |
| CVE-2014-9038 | – | Nov 25 | wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF)… Affected: through 3.7.4; 3.8; 3.8.1; 3.8.2; 3.8.3; 3.8.4; +4 more |
| CVE-2014-9037 | – | Nov 25 | WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an… Affected: through 3.7.4; 3.8; 3.8.1; 3.8.2; 3.8.3; 3.8.4; +4 more |
| CVE-2014-9036 | – | Nov 25 | Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web… Affected: through 3.7.4; 3.8; 3.8.1; 3.8.2; 3.8.3; 3.8.4; +4 more |
| CVE-2014-9035 | – | Nov 25 | Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject… Affected: through 3.7.4; 3.8; 3.8.1; 3.8.2; 3.8.3; 3.8.4; +4 more |
| CVE-2014-9034 | – | Nov 25 | wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU… Affected: through 3.7.4; 3.8; 3.8.1; 3.8.2; 3.8.3; 3.8.4; +4 more |
| CVE-2014-9033 | – | Nov 25 | Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users… Affected: 3.7.4; 3.8.4; 3.9.2; 4.0 |
| CVE-2014-9032 | – | Nov 25 | Cross-site scripting (XSS) vulnerability in the media-playlists feature in WordPress before 3.9.x before 3.9.3 and 4.x before 4.0.1 allows remote attackers to inject arbitrary web… Affected: 3.9; 3.9.1; 3.9.2; 4.0 |
| CVE-2014-9031 | – | Nov 25 | Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject… Affected: through 3.7.4; 3.8; 3.8.1; 3.8.2; 3.8.3; 3.8.4; +3 more |
| CVE-2003-1599 | – | Oct 27 | PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code via a URL in the $abspath variable Affected: 0.70 |
| CVE-2003-1598 | – | Oct 1 | SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable Affected: through 0.7 |