WO
CMS
WordPress
On CISA KEVExploited in the wild
369
CVEs
7
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 20High 48Medium 105Low 3
Watch
Add WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2006-2702 | – | May 31 | vars.php in WordPress 2.0.2, possibly when running on Mac OS X, allows remote attackers to spoof their IP address via a PC_REMOTE_ADDR HTTP header, which vars.php uses to redefine… Affected: 2.0.2 |
| CVE-2006-2667 | – | May 30 | Direct static code injection vulnerability in WordPress 2.0.2 and earlier allows remote attackers to execute arbitrary commands by inserting a carriage return and PHP code when… Affected: through 2.0.2 |
| CVE-2006-1796 | – | Apr 17 | Cross-site scripting (XSS) vulnerability in the paging links functionality in template-functions-links.php in Wordpress 1.5.2, and possibly other versions before 2.0.1, allows… Affected: through 2.0; 0.6.2; 0.6.2.1; 0.7; 0.71; 1.0; +11 more |
| CVE-2006-1263 | – | Mar 19 | Multiple "unannounced" cross-site scripting (XSS) vulnerabilities in WordPress before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack… Affected: 0.6.2; 0.6.2.1; 0.7; 0.71; 1.2; 1.2.1; +8 more |
| CVE-2006-1012 | – | Mar 6 | SQL injection vulnerability in WordPress 1.5.2, and possibly other versions before 2.0, allows remote attackers to execute arbitrary SQL commands via the User-Agent field in an… Affected: 1.5.2 |
| CVE-2006-0986 | – | Mar 3 | WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) default-filters.php, (2) template-loader.php, (3)… Affected: 1.0; 1.0.1; 1.0.2; 1.2; 1.5; 1.5.1; +4 more |
| CVE-2006-0985 | – | Mar 3 | Multiple cross-site scripting (XSS) vulnerabilities in the "post comment" functionality of WordPress 2.0.1 and earlier allow remote attackers to inject arbitrary web script or… Affected: 1.0; 1.0.1; 1.0.2; 1.2; 1.5; 1.5.1; +4 more |
| CVE-2006-0733 | – | Feb 16 | Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes such as (1) onfocus and (2)… Affected: 2.0 |
| CVE-2005-4463 | – | Dec 21 | WordPress before 1.5.2 allows remote attackers to obtain sensitive information via a direct request to (1) wp-includes/vars.php, (2) wp-content/plugins/hello.php, (3)… Affected: 1.0; 1.0.1; 1.0.2; 1.2; 1.5; 1.5.1; +3 more |
| CVE-2005-2612 | – | Aug 17 | Direct code injection vulnerability in WordPress 1.5.1.3 and earlier allows remote attackers to execute arbitrary PHP code via the cache_lastpostdate[server] cookie Affected: 1.0; 1.0.1; 1.0.2; 1.2; 1.5; 1.5.1; +2 more |
| CVE-2005-2110 | – | Jul 5 | WordPress 1.5.1.2 and earlier allows remote attackers to obtain sensitive information via (1) a direct request to menu-header.php or a "1" value in the feed parameter to (2)… Affected: 1.0; 1.0.1; 1.0.2; 1.2; 1.5; 1.5.1; +1 more |
| CVE-2005-2109 | – | Jul 5 | wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the message variable, which is not… Affected: 1.0; 1.0.1; 1.0.2; 1.2; 1.5; 1.5.1; +1 more |
| CVE-2005-2108 | – | Jul 5 | SQL injection vulnerability in XMLRPC server in WordPress 1.5.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via input that is not filtered in the… Affected: 1.0; 1.0.1; 1.0.2; 1.2; 1.5; 1.5.1; +1 more |
| CVE-2005-2107 | – | Jul 5 | Multiple cross-site scripting (XSS) vulnerabilities in post.php in WordPress 1.5.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) p or (2)… Affected: 1.0; 1.0.1; 1.0.2; 1.2; 1.5; 1.5.1; +1 more |
| CVE-2005-1810 | – | Jun 1 | SQL injection vulnerability in template-functions-category.php in WordPress 1.5.1 allows remote attackers to execute arbitrary SQL commands via the $cat_ID variable, as… Affected: 1.5.1 |
| CVE-2005-1687 | – | May 20 | SQL injection vulnerability in wp-trackback.php in Wordpress 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the tb_id parameter Affected: 1.5 |
| CVE-2005-1102 | – | May 2 | Multiple cross-site scripting (XSS) vulnerabilities in template-functions-post.php in WordPress 1.5 and earlier allow remote attackers to execute arbitrary commands via the (1)… Affected: through 1.5 |
| CVE-2004-1584 | – | Dec 31 | CRLF injection vulnerability in wp-login.php in WordPress 1.2 allows remote attackers to perform HTTP Response Splitting attacks to modify expected HTML content from the server… Affected: 1.2 |
| CVE-2004-1559 | – | Dec 31 | Multiple cross-site scripting (XSS) vulnerabilities in Wordpress 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) redirect_to, text, popupurl, or… Affected: 1.2 |