Lỗ hổng bảo mật WordPress
351 lỗ hổng của lõi WordPress có ghi khoảng phiên bản, mới nhất trước; những lỗ hổng chỉ chạm tới bản trước 5.0 được gấp ở cuối. Cập nhật 31/10/2026.
Bản an toàn của từng nhánh
WordPress chuyển bản vá bảo mật về cả các nhánh cũ. Ở nhánh nào, chỉ cần lên bản cuối của nhánh đó (theo WordPress.org).
- 7.1.4mới nhất
- 7.0.8
- 6.9.11
- 6.8.12
- 6.7.11
- 6.6.11
- 6.5.14
- 6.4.14
- 6.3.14
- 6.2.15
- 6.1.16
- 6.0.18
- 5.9.20
- 5.8.19
- 5.7.21
- 5.6.23
- 5.5.24
- 5.4.25
- 5.3.27
- 5.2.30
- 5.1.28
- 5.0.31
- 4.9.35
- 4.8.34
- 4.7.39
Tóm tắt giữ nguyên tiếng Anh như trong cảnh báo gốc.
| Ngày công bố | Mức độ | CVE | Tóm tắt | Tới bản |
|---|---|---|---|---|
| 22/09/2026 | CaoCVSS 8.1 | CVE-2026-87902 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE. | < 7.1.225 nhánh |
| 17/07/2026 | Trung bìnhCVSS 5.9 | CVE-2026-60137 | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter. | < 7.0.23 nhánh |
| 17/07/2026 | Nghiêm trọngCVSS 9.8 | CVE-2026-63030 | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution. | < 7.0.22 nhánh |
| 16/10/2024 | Trung bìnhCVSS 4.9 | CVE-2022-4973 | WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page. | ≤ 6.0.2 |
| 03/05/2024 | CaoCVSS 7.2 | CVE-2024-4439 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, | ≤ 6.5.16 nhánh |
| 04/04/2024 | CaoCVSS 7.6 | CVE-2024-31210 | WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins -> Add New -> Upload Plugin screen in WordPress. If FTP credentials are requested for installation (in order to move the file into place outside of the `uploads` directory) then the uploaded file remains temporary av | < 6.4.324 nhánh |
| 04/04/2024 | Trung bìnhCVSS 5.5 | CVE-2024-31211 | WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected. | < 6.4.2 |
| 16/10/2023 | Trung bìnhCVSS 5.3 | CVE-2023-5561 | WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack | < 6.3.217 nhánh |
| 13/10/2023 | Trung bìnhCVSS 6.5 | CVE-2023-38000 | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions. | ≤ 6.3.15 nhánh |
| 13/10/2023 | Trung bìnhCVSS 4.3 | CVE-2023-39999 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 th | < 6.3.223 nhánh |
| 17/05/2023 | Trung bìnhCVSS 5.4 | CVE-2023-2745 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack. | ≤ 6.222 nhánh |
| 05/01/2023 | Trung bìnhCVSS 5.3 | CVE-2023-22622 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on in | ≤ 6.1.1 |
| 14/12/2022 | Trung bìnhCVSS 5.9 | CVE-2022-3590 | WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden. | ≤ 6.1.12 nhánh |
| 05/12/2022 | Trung bìnhCVSS 6.1 | CVE-2022-43497 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. | < 6.0.324 nhánh |
| 05/12/2022 | Trung bìnhCVSS 6.1 | CVE-2022-43500 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. | < 6.0.324 nhánh |
| 05/12/2022 | Trung bìnhCVSS 5.3 | CVE-2022-43504 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7. | < 6.0.324 nhánh |
| 06/01/2022 | CaoCVSS 8 | CVE-2022-21661 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. W | < 5.8.322 nhánh |
| 06/01/2022 | CaoCVSS 8 | CVE-2022-21662 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go bac | < 5.8.3 |
| 06/01/2022 | Trung bìnhCVSS 6.6 | CVE-2022-21663 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly re | < 5.8.3 |
| 06/01/2022 | CaoCVSS 7.4 | CVE-2022-21664 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 4.1.34. We strongly recommend that you | < 5.8.3 |
| 25/11/2021 | CaoCVSS 8.1 | CVE-2021-44223 | WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory. | < 5.8 |
| 09/09/2021 | Trung bìnhCVSS 5.3 | CVE-2021-39200 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on your behalf. This has been patched in WordPress 5.8.1, along with any older affected versions via mino | < 5.8.1 |
| 09/09/2021 | CaoCVSS 7.6 | CVE-2021-39201 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress | < 5.8 |
| 09/09/2021 | CaoCVSS 7.6 | CVE-2021-39202 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta pha | ≤ 5.82 nhánh |
| 09/09/2021 | Trung bìnhCVSS 6.8 | CVE-2021-39203 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release. | ≤ 5.8 |
| 28/04/2021 | Nghiêm trọngCVSS 9.8 | CVE-2020-36326 | PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exp | < 5.7.221 nhánh |
| 15/04/2021 | CaoCVSS 7.1 | CVE-2021-29447 | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. W | < 5.7.1 |
| 15/04/2021 | Trung bìnhCVSS 6.5 | CVE-2021-29450 | Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix. | < 5.7.1 |
| 02/11/2020 | Nghiêm trọngCVSS 9.8 | CVE-2020-28032 | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. | < 5.5.2 |
| 02/11/2020 | CaoCVSS 7.5 | CVE-2020-28033 | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. | < 5.5.2 |
| 02/11/2020 | Trung bìnhCVSS 6.1 | CVE-2020-28034 | WordPress before 5.5.2 allows XSS associated with global variables. | < 5.5.2 |
| 02/11/2020 | Nghiêm trọngCVSS 9.8 | CVE-2020-28035 | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. | < 5.5.2 |
| 02/11/2020 | Nghiêm trọngCVSS 9.8 | CVE-2020-28036 | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. | < 5.5.2 |
| 02/11/2020 | Nghiêm trọngCVSS 9.8 | CVE-2020-28037 | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation). | < 5.5.2 |
| 02/11/2020 | Trung bìnhCVSS 6.1 | CVE-2020-28038 | WordPress before 5.5.2 allows stored XSS via post slugs. | < 5.5.2 |
| 02/11/2020 | Nghiêm trọngCVSS 9.1 | CVE-2020-28039 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected. | < 5.5.2 |
| 02/11/2020 | Trung bìnhCVSS 4.3 | CVE-2020-28040 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. | < 5.5.2 |
| 13/09/2020 | Trung bìnhCVSS 5.3 | CVE-2020-25286 | In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public. | < 5.4.2 |
| 12/06/2020 | Trung bìnhCVSS 5.4 | CVE-2020-4046 | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor | < 5.4.218 nhánh |
| 12/06/2020 | Trung bìnhCVSS 6.8 | CVE-2020-4047 | In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5 | < 5.4.218 nhánh |
| 12/06/2020 | Trung bìnhCVSS 5.7 | CVE-2020-4048 | In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, | < 5.4.218 nhánh |
| 12/06/2020 | ThấpCVSS 2.4 | CVE-2020-4049 | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, | < 5.4.218 nhánh |
| 12/06/2020 | ThấpCVSS 3.5 | CVE-2020-4050 | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1 | < 5.4.218 nhánh |
| 30/04/2020 | Trung bìnhCVSS 5.8 | CVE-2020-11025 | In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.2 | < 5.4.1 |
| 30/04/2020 | CaoCVSS 8.7 | CVE-2020-11026 | In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4. | ≤ 5.418 nhánh |
| 30/04/2020 | Trung bìnhCVSS 6.1 | CVE-2020-11027 | In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5. | ≤ 5.418 nhánh |
| 30/04/2020 | Trung bìnhCVSS 5.8 | CVE-2020-11028 | In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.3 | < 5.4.1 |
| 30/04/2020 | Trung bìnhCVSS 5.8 | CVE-2020-11029 | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3 | ≤ 5.418 nhánh |
| 30/04/2020 | Trung bìnhCVSS 6.4 | CVE-2020-11030 | In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, | < 5.4.1 |
| 27/12/2019 | Nghiêm trọngCVSS 9.8 | CVE-2019-20041 | wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring. | < 5.3.1 |
| 27/12/2019 | Trung bìnhCVSS 6.1 | CVE-2019-20042 | In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. | < 5.3.1 |
| 27/12/2019 | Trung bìnhCVSS 4.3 | CVE-2019-20043 | In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous Word | < 5.3.1 |
| 26/12/2019 | Trung bìnhCVSS 5.8 | CVE-2019-16780 | WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 | < 5.3.12 nhánh |
| 26/12/2019 | Trung bìnhCVSS 5.8 | CVE-2019-16781 | In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS. | < 5.3.1 |
| 17/10/2019 | Nghiêm trọngCVSS 9.8 | CVE-2019-17669 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters. | < 5.2.4 |
| 17/10/2019 | Nghiêm trọngCVSS 9.8 | CVE-2019-17670 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs. | < 5.2.4 |
| 17/10/2019 | Trung bìnhCVSS 5.3 | CVE-2019-17671 | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled. | < 5.2.4 |
| 17/10/2019 | Trung bìnhCVSS 6.1 | CVE-2019-17672 | WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements. | < 5.2.4 |
| 17/10/2019 | CaoCVSS 7.5 | CVE-2019-17673 | WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header. | < 5.2.4 |
| 17/10/2019 | Trung bìnhCVSS 5.4 | CVE-2019-17674 | WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer. | < 5.2.4 |
| 17/10/2019 | CaoCVSS 8.8 | CVE-2019-17675 | WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF. | < 5.2.4 |
| 11/09/2019 | Trung bìnhCVSS 6.1 | CVE-2019-16217 | WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. | < 5.2.3 |
| 11/09/2019 | Trung bìnhCVSS 6.1 | CVE-2019-16218 | WordPress before 5.2.3 allows XSS in stored comments. | < 5.2.3 |
| 11/09/2019 | Trung bìnhCVSS 6.1 | CVE-2019-16219 | WordPress before 5.2.3 allows XSS in shortcode previews. | < 5.2.3 |
| 11/09/2019 | Trung bìnhCVSS 6.1 | CVE-2019-16220 | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash. | < 5.2.3 |
| 11/09/2019 | Trung bìnhCVSS 6.1 | CVE-2019-16221 | WordPress before 5.2.3 allows reflected XSS in the dashboard. | < 5.2.3 |
| 11/09/2019 | Trung bìnhCVSS 6.1 | CVE-2019-16222 | WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks. | < 5.2.3 |
| 11/09/2019 | Trung bìnhCVSS 5.4 | CVE-2019-16223 | WordPress before 5.2.3 allows XSS in post previews by authenticated users. | < 5.2.3 |
| 14/03/2019 | CaoCVSS 8.8 | CVE-2019-9787 | WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related | < 5.1.1 |
| 20/02/2019 | CaoCVSS 8.8 | CVE-2019-8942 | WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943. | ≤ 5.010 nhánh |
| 20/02/2019 | Trung bìnhCVSS 6.5 | CVE-2019-8943 | WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring. | ≤ 5.0.3 |
| 14/12/2018 | Trung bìnhCVSS 6.5 | CVE-2018-20147 | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files. | < 5.0.12 nhánh |
| 14/12/2018 | Nghiêm trọngCVSS 9.8 | CVE-2018-20148 | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php. | < 5.0.12 nhánh |
| 14/12/2018 | Trung bìnhCVSS 5.4 | CVE-2018-20149 | In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data. | < 5.0.12 nhánh |
| 14/12/2018 | Trung bìnhCVSS 6.1 | CVE-2018-20150 | In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins. | < 5.0.12 nhánh |
| 14/12/2018 | CaoCVSS 7.5 | CVE-2018-20151 | In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default. | < 5.0.12 nhánh |
| 14/12/2018 | Trung bìnhCVSS 6.5 | CVE-2018-20152 | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input. | < 5.0.12 nhánh |
| 14/12/2018 | Trung bìnhCVSS 5.4 | CVE-2018-20153 | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS. | < 5.0.12 nhánh |
| 16/11/2018 | CaoCVSS 8.8 | CVE-2018-19296 | PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack. | ≤ 5.7 |
272 lỗ hổng chỉ chạm tới bản trước 5.0 (chỉ đáng lo nếu trang còn chạy WordPress 4.x trở về trước)
| Ngày công bố | Mức độ | CVE | Tới bản |
|---|---|---|---|
| 18/04/2022 | Trung bìnhCVSS 6.5 | CVE-2011-1762 | < 3.1.22 nhánh |
| 22/05/2019 | Trung bìnhCVSS 5.3 | CVE-2017-6514 | ≤ 4.7.2 |
| 06/09/2018 | CaoCVSS 8.8 | CVE-2017-1000600 | < 4.9 |
| 06/09/2018 | CaoCVSS 8.8 | CVE-2018-1000773 | ≤ 4.9.8 |
| 10/08/2018 | CaoCVSS 7.2 | CVE-2018-14028 | ≤ 4.9.7 |
| 26/06/2018 | CaoCVSS 8.8 | CVE-2018-12895 | < 4.9.7 |
| 16/04/2018 | Trung bìnhCVSS 6.1 | CVE-2018-10100 | < 4.9.5 |
| 16/04/2018 | Trung bìnhCVSS 6.1 | CVE-2018-10101 | < 4.9.5 |
| 16/04/2018 | Trung bìnhCVSS 6.1 | CVE-2018-10102 | < 4.9.5 |
| 12/04/2018 | CaoCVSS 8.1 | CVE-2014-6412 | < 4.4.0 |
| 06/02/2018 | CaoCVSS 7.5 | CVE-2018-6389 | ≤ 4.9.2 |
| 18/01/2018 | Trung bìnhCVSS 6.1 | CVE-2018-5776 | < 4.9.2 |
| 02/12/2017 | CaoCVSS 8.8 | CVE-2017-17091 | ≤ 4.9 |
| 02/12/2017 | Trung bìnhCVSS 5.4 | CVE-2017-17092 | < 4.9.1 |
| 02/12/2017 | Trung bìnhCVSS 5.4 | CVE-2017-17093 | < 4.9.1 |
| 02/12/2017 | Trung bìnhCVSS 5.4 | CVE-2017-17094 | < 4.9.1 |
| 02/11/2017 | Nghiêm trọngCVSS 9.8 | CVE-2017-16510 | ≤ 4.8.2 |
| 19/10/2017 | CaoCVSS 7.5 | CVE-2012-6707 | ≤ 4.8.2 |
| 12/10/2017 | Trung bìnhCVSS 4.7 | CVE-2016-9263 | ≤ 4.8.2 |
| 03/10/2017 | Trung bìnhCVSS 6.5 | CVE-2017-14990 | ≤ 4.8.2 |
| 23/09/2017 | Trung bìnhCVSS 6.1 | CVE-2017-14718 | ≤ 4.8.1 |
| 23/09/2017 | CaoCVSS 7.5 | CVE-2017-14719 | ≤ 4.8.1202 nhánh |
| 23/09/2017 | Trung bìnhCVSS 6.1 | CVE-2017-14720 | ≤ 4.8.1 |
| 23/09/2017 | Trung bìnhCVSS 6.1 | CVE-2017-14721 | ≤ 4.8.1 |
| 23/09/2017 | CaoCVSS 7.5 | CVE-2017-14722 | ≤ 4.8.18 nhánh |
| 23/09/2017 | Nghiêm trọngCVSS 9.8 | CVE-2017-14723 | ≤ 4.8.1 |
| 23/09/2017 | Trung bìnhCVSS 6.1 | CVE-2017-14724 | ≤ 4.8.1 |
| 23/09/2017 | Trung bìnhCVSS 5.4 | CVE-2017-14725 | ≤ 4.8.1 |
| 23/09/2017 | Trung bìnhCVSS 6.1 | CVE-2017-14726 | ≤ 4.8.1 |
| 18/05/2017 | Trung bìnhCVSS 6.1 | CVE-2017-9061 | ≤ 4.7.4 |
| 18/05/2017 | CaoCVSS 8.6 | CVE-2017-9062 | ≤ 4.7.4 |
| 18/05/2017 | Trung bìnhCVSS 6.1 | CVE-2017-9063 | ≤ 4.7.4 |
| 18/05/2017 | CaoCVSS 8.8 | CVE-2017-9064 | ≤ 4.7.4 |
| 18/05/2017 | CaoCVSS 7.5 | CVE-2017-9065 | ≤ 4.7.4 |
| 18/05/2017 | CaoCVSS 8.6 | CVE-2017-9066 | ≤ 4.7.4 |
| 04/05/2017 | Trung bìnhCVSS 5.9 | CVE-2017-8295 | ≤ 4.7.4 |
| 03/04/2017 | CaoCVSS 7.5 | CVE-2017-1001000 | ≤ 4.7.23 nhánh |
| 12/03/2017 | Trung bìnhCVSS 5.4 | CVE-2017-6814 | ≤ 4.7.2 |
| 12/03/2017 | Trung bìnhCVSS 6.1 | CVE-2017-6815 | ≤ 4.7.2 |
| 12/03/2017 | Trung bìnhCVSS 4.9 | CVE-2017-6816 | ≤ 4.7.2 |
| 12/03/2017 | Trung bìnhCVSS 5.4 | CVE-2017-6817 | ≤ 4.7.2 |
| 12/03/2017 | Trung bìnhCVSS 6.1 | CVE-2017-6818 | ≤ 4.7.2 |
| 12/03/2017 | Trung bìnhCVSS 6.5 | CVE-2017-6819 | ≤ 4.7.2 |
| 30/01/2017 | Trung bìnhCVSS 5.3 | CVE-2017-5610 | ≤ 4.7.1 |
| 30/01/2017 | Nghiêm trọngCVSS 9.8 | CVE-2017-5611 | ≤ 4.7.1 |
| 30/01/2017 | Trung bìnhCVSS 6.1 | CVE-2017-5612 | ≤ 4.7.1 |
| 18/01/2017 | Trung bìnhCVSS 4.3 | CVE-2016-10148 | ≤ 4.5.5 |
| 18/01/2017 | CaoCVSS 7.1 | CVE-2016-6896 | ≤ 4.5.3 |
| 18/01/2017 | Trung bìnhCVSS 6.5 | CVE-2016-6897 | ≤ 4.5.5 |
| 15/01/2017 | Trung bìnhCVSS 5.3 | CVE-2017-5487 | ≤ 4.7 |
| 15/01/2017 | Trung bìnhCVSS 6.1 | CVE-2017-5488 | ≤ 4.7 |
| 15/01/2017 | CaoCVSS 8.8 | CVE-2017-5489 | ≤ 4.7 |
| 15/01/2017 | Trung bìnhCVSS 6.1 | CVE-2017-5490 | ≤ 4.7 |
| 15/01/2017 | Trung bìnhCVSS 5.3 | CVE-2017-5491 | ≤ 4.7 |
| 15/01/2017 | CaoCVSS 8.8 | CVE-2017-5492 | ≤ 4.7 |
| 15/01/2017 | CaoCVSS 7.5 | CVE-2017-5493 | ≤ 4.7 |
| 05/01/2017 | Trung bìnhCVSS 4.8 | CVE-2016-7168 | ≤ 4.6 |
| 05/01/2017 | Trung bìnhCVSS 6.3 | CVE-2016-7169 | ≤ 4.6 |
| 30/12/2016 | Nghiêm trọngCVSS 9.8 | CVE-2016-10033 | ≤ 4.7 |
| 30/12/2016 | Nghiêm trọngCVSS 9.8 | CVE-2016-10045 | ≤ 4.7 |
| 07/08/2016 | CaoCVSS 8.6 | CVE-2016-4029 | < 4.5 |
| 07/08/2016 | Trung bìnhCVSS 6.1 | CVE-2016-6634 | ≤ 4.4.4 |
| 07/08/2016 | CaoCVSS 8.8 | CVE-2016-6635 | ≤ 4.4.2 |
| 29/06/2016 | CaoCVSS 7.5 | CVE-2016-5832 | ≤ 4.5.2 |
| 29/06/2016 | Trung bìnhCVSS 6.1 | CVE-2016-5833 | ≤ 4.5.2 |
| 29/06/2016 | Trung bìnhCVSS 6.1 | CVE-2016-5834 | ≤ 4.5.2 |
| 29/06/2016 | CaoCVSS 7.5 | CVE-2016-5835 | ≤ 4.5.2 |
| 29/06/2016 | CaoCVSS 7.5 | CVE-2016-5836 | ≤ 4.5.2 |
| 29/06/2016 | CaoCVSS 7.5 | CVE-2016-5837 | ≤ 4.5.2 |
| 29/06/2016 | CaoCVSS 7.5 | CVE-2016-5838 | ≤ 4.5.2 |
| 29/06/2016 | CaoCVSS 7.5 | CVE-2016-5839 | ≤ 4.5.2 |
| 22/05/2016 | Trung bìnhCVSS 6.1 | CVE-2015-5714 | ≤ 4.3.0 |
| 22/05/2016 | Trung bìnhCVSS 4.3 | CVE-2015-5715 | ≤ 4.3.0 |
| 22/05/2016 | Trung bìnhCVSS 5.4 | CVE-2015-7989 | ≤ 4.3.0 |
| 22/05/2016 | Trung bìnhCVSS 6.1 | CVE-2015-8834 | ≤ 4.2.1 |
| 22/05/2016 | Trung bìnhCVSS 6.1 | CVE-2016-1564 | ≤ 4.4.0 |
| 22/05/2016 | CaoCVSS 7.4 | CVE-2016-2221 | ≤ 4.4.1 |
| 22/05/2016 | CaoCVSS 8.6 | CVE-2016-2222 | ≤ 4.4.1 |
| 22/05/2016 | Trung bìnhCVSS 6.1 | CVE-2016-4566 | ≤ 4.5.1 |
| 22/05/2016 | Trung bìnhCVSS 6.1 | CVE-2016-4567 | ≤ 4.5.1 |
| 09/11/2015 | CaoCVSS 7.5 | CVE-2015-2213 | ≤ 4.2.3 |
| 09/11/2015 | Trung bìnhCVSS 5 | CVE-2015-5730 | ≤ 4.2.3 |
| 09/11/2015 | Trung bìnhCVSS 6.8 | CVE-2015-5731 | ≤ 4.2.3 |
| 09/11/2015 | Trung bìnhCVSS 4.3 | CVE-2015-5732 | ≤ 4.2.3 |
| 09/11/2015 | Trung bìnhCVSS 4.3 | CVE-2015-5733 | ≤ 4.2.3 |
| 09/11/2015 | Trung bìnhCVSS 4.3 | CVE-2015-5734 | ≤ 4.2.3 |
| 05/08/2015 | Trung bìnhCVSS 4.3 | CVE-2015-3438 | ≤ 4.1.1 |
| 05/08/2015 | Trung bìnhCVSS 4.3 | CVE-2015-3439 | ≤ 4.1.18 nhánh |
| 03/08/2015 | Trung bìnhCVSS 4.3 | CVE-2015-3440 | ≤ 4.2 |
| 03/08/2015 | ThấpCVSS 3.5 | CVE-2015-5622 | ≤ 4.2.2 |
| 03/08/2015 | Trung bìnhCVSS 4 | CVE-2015-5623 | ≤ 4.2.2 |
| 25/11/2014 | Trung bìnhCVSS 4.3 | CVE-2014-9031 | ≤ 3.9.29 nhánh |
| 25/11/2014 | Trung bìnhCVSS 4.3 | CVE-2014-9032 | ≤ 4.04 nhánh |
| 25/11/2014 | Trung bìnhCVSS 6.8 | CVE-2014-9033 | ≤ 4.04 nhánh |
| 25/11/2014 | Trung bìnhCVSS 5 | CVE-2014-9034 | ≤ 4.010 nhánh |
| 25/11/2014 | Trung bìnhCVSS 4.3 | CVE-2014-9035 | ≤ 4.010 nhánh |
| 25/11/2014 | Trung bìnhCVSS 4.3 | CVE-2014-9036 | ≤ 4.010 nhánh |
| 25/11/2014 | Trung bìnhCVSS 6.8 | CVE-2014-9037 | ≤ 4.010 nhánh |
| 25/11/2014 | Trung bìnhCVSS 6.4 | CVE-2014-9038 | ≤ 4.010 nhánh |
| 25/11/2014 | Trung bìnhCVSS 4.3 | CVE-2014-9039 | ≤ 4.010 nhánh |
| 27/10/2014 | CaoCVSS 7.5 | CVE-2003-1599 | ≤ 0.70 |
| 01/10/2014 | CaoCVSS 7.5 | CVE-2003-1598 | ≤ 0.7 |
| 18/08/2014 | CaoCVSS 7.5 | CVE-2014-5203 | ≤ 3.9.12 nhánh |
| 18/08/2014 | Trung bìnhCVSS 6.8 | CVE-2014-5204 | ≤ 3.9.12 nhánh |
| 18/08/2014 | Trung bìnhCVSS 6.8 | CVE-2014-5205 | ≤ 3.9.12 nhánh |
| 18/08/2014 | ThấpCVSS 2.1 | CVE-2014-5240 | ≤ 3.9.132 nhánh |
| 18/08/2014 | Trung bìnhCVSS 5 | CVE-2014-5265 | ≤ 3.9.132 nhánh |
| 18/08/2014 | Trung bìnhCVSS 5 | CVE-2014-5266 | ≤ 3.9.132 nhánh |
| 10/04/2014 | Trung bìnhCVSS 4 | CVE-2014-0165 | ≤ 3.8.198 nhánh |
| 10/04/2014 | Trung bìnhCVSS 6.4 | CVE-2014-0166 | ≤ 3.8.198 nhánh |
| 21/01/2014 | Trung bìnhCVSS 5.8 | CVE-2010-5293 | ≤ 3.0.148 nhánh |
| 21/01/2014 | Trung bìnhCVSS 4.3 | CVE-2010-5294 | ≤ 3.0.148 nhánh |
| 21/01/2014 | Trung bìnhCVSS 4.3 | CVE-2010-5295 | ≤ 3.0.148 nhánh |
| 21/01/2014 | Trung bìnhCVSS 4.9 | CVE-2010-5296 | ≤ 3.0.148 nhánh |
| 21/01/2014 | ThấpCVSS 2.1 | CVE-2010-5297 | ≤ 3.047 nhánh |
| 21/01/2014 | Trung bìnhCVSS 4 | CVE-2011-5270 | ≤ 3.0.56 nhánh |
| 21/01/2014 | Trung bìnhCVSS 4.3 | CVE-2012-6633 | ≤ 3.3.218 nhánh |
| 21/01/2014 | Trung bìnhCVSS 6.4 | CVE-2012-6634 | ≤ 3.3.218 nhánh |
| 21/01/2014 | Trung bìnhCVSS 4 | CVE-2012-6635 | ≤ 3.3.218 nhánh |
| 30/12/2013 | Trung bìnhCVSS 6.8 | CVE-2013-7233 | ≤ 2.0.1111 nhánh |
| 12/09/2013 | CaoCVSS 7.5 | CVE-2013-4338 | ≤ 3.6 |
| 12/09/2013 | CaoCVSS 7.5 | CVE-2013-4339 | ≤ 3.6 |
| 12/09/2013 | ThấpCVSS 3.5 | CVE-2013-4340 | ≤ 3.6 |
| 12/09/2013 | Trung bìnhCVSS 4.3 | CVE-2013-5738 | ≤ 3.6 |
| 12/09/2013 | ThấpCVSS 3.5 | CVE-2013-5739 | ≤ 3.6 |
| 19/07/2013 | Trung bìnhCVSS 4.3 | CVE-2012-3414 | ≤ 3.3.116 nhánh |
| 08/07/2013 | Trung bìnhCVSS 6.4 | CVE-2013-0235 | ≤ 3.5.076 nhánh |
| 08/07/2013 | Trung bìnhCVSS 4.3 | CVE-2013-0236 | ≤ 3.5.076 nhánh |
| 08/07/2013 | Trung bìnhCVSS 4.3 | CVE-2013-0237 | ≤ 3.5.076 nhánh |
| 08/07/2013 | Trung bìnhCVSS 4.3 | CVE-2013-2199 | ≤ 3.5.177 nhánh |
| 08/07/2013 | Trung bìnhCVSS 4 | CVE-2013-2200 | ≤ 3.5.177 nhánh |
| 08/07/2013 | Trung bìnhCVSS 4.3 | CVE-2013-2201 | ≤ 3.5.177 nhánh |
| 08/07/2013 | Trung bìnhCVSS 4.3 | CVE-2013-2202 | ≤ 3.5.177 nhánh |
| 08/07/2013 | Trung bìnhCVSS 4.3 | CVE-2013-2203 | ≤ 3.5.177 nhánh |
| 08/07/2013 | Trung bìnhCVSS 4.3 | CVE-2013-2204 | ≤ 3.5.177 nhánh |
| 08/07/2013 | Trung bìnhCVSS 4.3 | CVE-2013-2205 | ≤ 3.5.177 nhánh |
| 21/06/2013 | Trung bìnhCVSS 4.3 | CVE-2013-2173 | ≤ 3.5.1 |
| 27/12/2012 | ThấpCVSS 2.6 | CVE-2012-5868 | ≤ 3.4.2 |
| 28/09/2012 | Trung bìnhCVSS 6.8 | CVE-2012-4448 | ≤ 3.4.2 |
| 14/09/2012 | Trung bìnhCVSS 6.5 | CVE-2010-5106 | ≤ 3.0.270 nhánh |
| 14/09/2012 | Trung bìnhCVSS 4 | CVE-2012-4421 | ≤ 3.4.187 nhánh |
| 14/09/2012 | ThấpCVSS 3.5 | CVE-2012-4422 | ≤ 3.4.188 nhánh |
| 22/07/2012 | ThấpCVSS 2.6 | CVE-2012-3383 | ≤ 3.4.0 |
| 22/07/2012 | Trung bìnhCVSS 6.8 | CVE-2012-3384 | ≤ 3.4.085 nhánh |
| 22/07/2012 | Trung bìnhCVSS 5 | CVE-2012-3385 | ≤ 3.4.085 nhánh |
| 27/06/2012 | Trung bìnhCVSS 4.3 | CVE-2011-4956 | ≤ 3.175 nhánh |
| 27/06/2012 | Trung bìnhCVSS 5 | CVE-2011-4957 | ≤ 3.175 nhánh |
| 03/05/2012 | Trung bìnhCVSS 6.8 | CVE-2012-1936 | ≤ 3.3.183 nhánh |
| 21/04/2012 | CaoCVSS 10 | CVE-2012-2399 | ≤ 3.3.180 nhánh |
| 21/04/2012 | CaoCVSS 10 | CVE-2012-2400 | ≤ 3.3.180 nhánh |
| 21/04/2012 | Trung bìnhCVSS 5 | CVE-2012-2401 | ≤ 3.3.180 nhánh |
| 21/04/2012 | Trung bìnhCVSS 5.5 | CVE-2012-2402 | ≤ 3.3.180 nhánh |
| 21/04/2012 | Trung bìnhCVSS 4.3 | CVE-2012-2403 | ≤ 3.3.180 nhánh |
| 21/04/2012 | Trung bìnhCVSS 4.3 | CVE-2012-2404 | ≤ 3.3.180 nhánh |
| 30/01/2012 | Trung bìnhCVSS 5 | CVE-2011-4898 | ≤ 3.3.173 nhánh |
| 30/01/2012 | CaoCVSS 7.5 | CVE-2011-4899 | ≤ 3.3.173 nhánh |
| 30/01/2012 | Trung bìnhCVSS 4.3 | CVE-2012-0782 | ≤ 3.3.173 nhánh |
| 30/01/2012 | Trung bìnhCVSS 5 | CVE-2012-0937 | ≤ 3.3.173 nhánh |
| 06/01/2012 | ThấpCVSS 2.6 | CVE-2012-0287 | ≤ 3.3 |
| 24/09/2011 | Trung bìnhCVSS 5 | CVE-2011-3818 | ≤ 3.0.42 nhánh |
| 10/08/2011 | CaoCVSS 10 | CVE-2011-3122 | ≤ 3.24 nhánh |
| 10/08/2011 | CaoCVSS 10 | CVE-2011-3125 | ≤ 3.24 nhánh |
| 10/08/2011 | Trung bìnhCVSS 5 | CVE-2011-3126 | ≤ 3.24 nhánh |
| 10/08/2011 | Trung bìnhCVSS 5.8 | CVE-2011-3127 | ≤ 3.24 nhánh |
| 10/08/2011 | Trung bìnhCVSS 5 | CVE-2011-3128 | ≤ 3.24 nhánh |
| 10/08/2011 | CaoCVSS 9.3 | CVE-2011-3129 | ≤ 3.24 nhánh |
| 10/08/2011 | CaoCVSS 7.5 | CVE-2011-3130 | ≤ 3.24 nhánh |
| 14/03/2011 | ThấpCVSS 3.5 | CVE-2011-0700 | ≤ 3.0.4 |
| 14/03/2011 | Trung bìnhCVSS 4 | CVE-2011-0701 | ≤ 3.0.4 |
| 03/01/2011 | Trung bìnhCVSS 4.3 | CVE-2010-4536 | ≤ 3.0.3 |
| 07/12/2010 | Trung bìnhCVSS 6 | CVE-2010-4257 | ≤ 3.0.1 |
| 23/02/2010 | Trung bìnhCVSS 4 | CVE-2010-0682 | ≤ 2.9.14 nhánh |
| 17/11/2009 | Trung bìnhCVSS 6 | CVE-2009-3890 | ≤ 2.8.5 |
| 17/11/2009 | ThấpCVSS 3.5 | CVE-2009-3891 | ≤ 2.8.5 |
| 23/10/2009 | Trung bìnhCVSS 4.3 | CVE-2009-3622 | ≤ 2.8.4 |
| 18/08/2009 | Trung bìnhCVSS 4.3 | CVE-2009-2851 | ≤ 2.8.1 |
| 18/08/2009 | CaoCVSS 10 | CVE-2009-2853 | ≤ 2.8.257 nhánh |
| 18/08/2009 | Trung bìnhCVSS 6.4 | CVE-2009-2854 | ≤ 2.8.2 |
| 13/08/2009 | CaoCVSS 7.5 | CVE-2009-2762 | ≤ 2.8.3 |
| 10/07/2009 | Trung bìnhCVSS 4.9 | CVE-2009-2334 | ≤ 2.7.180 nhánh |
| 10/07/2009 | Trung bìnhCVSS 5 | CVE-2009-2335 | < 2.8.1 |
| 10/07/2009 | Trung bìnhCVSS 5 | CVE-2009-2336 | < 2.8.1 |
| 10/07/2009 | Trung bìnhCVSS 5 | CVE-2009-2431 | ≤ 2.7.1 |
| 10/07/2009 | Trung bìnhCVSS 5 | CVE-2009-2432 | ≤ 2.7.180 nhánh |
| 28/04/2009 | Trung bìnhCVSS 4.3 | CVE-2008-6762 | ≤ 2.6 |
| 28/04/2009 | CaoCVSS 10 | CVE-2008-6767 | ≤ 2.6 |
| 19/12/2008 | CaoCVSS 8.5 | CVE-2008-5695 | ≤ 2.3.2 |
| 28/11/2008 | Trung bìnhCVSS 4.3 | CVE-2008-5278 | ≤ 2.6.374 nhánh |
| 17/11/2008 | Trung bìnhCVSS 4 | CVE-2008-5113 | ≤ 2.6.3 |
| 30/10/2008 | CaoCVSS 10 | CVE-2008-4796 | < 2.6.3 |
| 28/10/2008 | CaoCVSS 9.3 | CVE-2008-4769 | ≤ 2.568 nhánh |
| 18/09/2008 | Trung bìnhCVSS 5.1 | CVE-2008-4106 | ≤ 2.6.134 nhánh |
| 27/08/2008 | CaoCVSS 7.5 | CVE-2008-3747 | ≤ 2.645 nhánh |
| 18/07/2008 | Trung bìnhCVSS 4.3 | CVE-2008-3233 | ≤ 2.5.154 nhánh |
| 21/05/2008 | CaoCVSS 9 | CVE-2008-2392 | ≤ 2.5.1 |
| 12/05/2008 | CaoCVSS 7.5 | CVE-2008-2146 | ≤ 2.2.247 nhánh |
| 02/05/2008 | Trung bìnhCVSS 4.3 | CVE-2008-2068 | ≤ 2.5 |
| 28/04/2008 | CaoCVSS 7.5 | CVE-2008-1930 | ≤ 2.5 |
| 12/03/2008 | Trung bìnhCVSS 4.3 | CVE-2008-1304 | ≤ 2.3.2 |
| 08/02/2008 | Trung bìnhCVSS 6.4 | CVE-2008-0664 | ≤ 2.3.238 nhánh |
| 10/01/2008 | Trung bìnhCVSS 5 | CVE-2008-0191 | ≤ 2.32 nhánh |
| 10/01/2008 | Trung bìnhCVSS 4.3 | CVE-2008-0192 | ≤ 2.0.9 |
| 10/01/2008 | Trung bìnhCVSS 4.3 | CVE-2008-0193 | ≤ 2.315 nhánh |
| 10/01/2008 | CaoCVSS 7.5 | CVE-2008-0194 | ≤ 2.0.3 |
| 10/01/2008 | Trung bìnhCVSS 5 | CVE-2008-0195 | ≤ 2.0.11 |
| 10/01/2008 | Trung bìnhCVSS 5 | CVE-2008-0196 | ≤ 2.0.11 |
| 12/12/2007 | Trung bìnhCVSS 6.8 | CVE-2007-6318 | ≤ 2.3.124 nhánh |
| 19/11/2007 | Nghiêm trọngCVSS 9.8 | CVE-2007-6013 | ≤ 2.3.1 |
| 30/10/2007 | ThấpCVSS 2.6 | CVE-2007-5710 | ≤ 2.3 |
| 26/09/2007 | Trung bìnhCVSS 4.3 | CVE-2007-5105 | ≤ 2.0.12 nhánh |
| 26/09/2007 | Trung bìnhCVSS 4.3 | CVE-2007-5106 | ≤ 2.0 |
| 14/09/2007 | Trung bìnhCVSS 4.3 | CVE-2007-4893 | ≤ 2.2.231 nhánh |
| 14/09/2007 | CaoCVSS 7.5 | CVE-2007-4894 | ≤ 2.2.231 nhánh |
| 03/08/2007 | Trung bìnhCVSS 4.3 | CVE-2007-4139 | ≤ 2.2.1 |
| 03/08/2007 | ThấpCVSS 2.1 | CVE-2007-4153 | ≤ 2.2.1 |
| 03/08/2007 | Trung bìnhCVSS 6.5 | CVE-2007-4154 | ≤ 2.2.1 |
| 10/07/2007 | Trung bìnhCVSS 4 | CVE-2007-3639 | ≤ 2.2.1 |
| 03/07/2007 | Trung bìnhCVSS 6 | CVE-2007-3543 | ≤ 2.2.0 |
| 03/07/2007 | Trung bìnhCVSS 6.5 | CVE-2007-3544 | ≤ 2.2.0 |
| 15/06/2007 | Trung bìnhCVSS 6 | CVE-2007-3238 | ≤ 2.2 |
| 15/06/2007 | Trung bìnhCVSS 4.3 | CVE-2007-3239 | ≤ 2.2 |
| 15/06/2007 | Trung bìnhCVSS 4.3 | CVE-2007-3240 | ≤ 2.2 |
| 15/06/2007 | Trung bìnhCVSS 4.3 | CVE-2007-3241 | ≤ 2.2 |
| 08/06/2007 | Trung bìnhCVSS 6.5 | CVE-2007-3140 | ≤ 2.2 |
| 22/05/2007 | CaoCVSS 7.5 | CVE-2007-2821 | ≤ 2.1.3 |
| 09/04/2007 | Trung bìnhCVSS 4.9 | CVE-2007-1893 | ≤ 2.1.2 |
| 09/04/2007 | Trung bìnhCVSS 4.3 | CVE-2007-1894 | ≤ 2.1.212 nhánh |
| 09/04/2007 | Trung bìnhCVSS 6.5 | CVE-2007-1897 | ≤ 2.1.23 nhánh |
| 28/03/2007 | ThấpCVSS 3.5 | CVE-2007-1732 | ≤ 2.1.2 |
| 23/03/2007 | Trung bìnhCVSS 4.3 | CVE-2007-1622 | ≤ 2.1.214 nhánh |
| 22/03/2007 | Trung bìnhCVSS 6.5 | CVE-2007-1599 | ≤ 2.1.2 |
| 10/03/2007 | Trung bìnhCVSS 5 | CVE-2007-1409 | ≤ 2.1.110 nhánh |
| 05/03/2007 | CaoCVSS 7.5 | CVE-2007-1277 | ≤ 2.1.1 |
| 03/03/2007 | Trung bìnhCVSS 6.8 | CVE-2007-1244 | ≤ 2.1.1 |
| 02/03/2007 | Trung bìnhCVSS 5.8 | CVE-2007-1230 | ≤ 2.1 |
| 21/02/2007 | Trung bìnhCVSS 4.3 | CVE-2007-1049 | ≤ 2.0.720 nhánh |
| 29/01/2007 | CaoCVSS 7.8 | CVE-2007-0539 | ≤ 2.0 |
| 29/01/2007 | Trung bìnhCVSS 5 | CVE-2007-0540 | ≤ 2.0 |
| 29/01/2007 | Trung bìnhCVSS 5 | CVE-2007-0541 | ≤ 2.0 |
| 16/01/2007 | CaoCVSS 7.8 | CVE-2007-0262 | ≤ 2.12 nhánh |
| 13/01/2007 | CaoCVSS 7.5 | CVE-2007-0233 | ≤ 2.0.619 nhánh |
| 09/01/2007 | Trung bìnhCVSS 6.8 | CVE-2007-0106 | ≤ 2.0.56 nhánh |
| 09/01/2007 | Trung bìnhCVSS 6.8 | CVE-2007-0107 | ≤ 2.0.5 |
| 09/01/2007 | Trung bìnhCVSS 5 | CVE-2007-0109 | ≤ 2.0.56 nhánh |
| 28/12/2006 | Trung bìnhCVSS 6.8 | CVE-2006-6808 | ≤ 2.0.518 nhánh |
| 21/11/2006 | Trung bìnhCVSS 6.5 | CVE-2006-6016 | ≤ 2.0.4 |
| 21/11/2006 | Trung bìnhCVSS 6.5 | CVE-2006-6017 | ≤ 2.0.5 |
| 04/11/2006 | Trung bìnhCVSS 6 | CVE-2006-5705 | ≤ 2.0.43 nhánh |
| 13/09/2006 | Trung bìnhCVSS 5 | CVE-2006-4743 | ≤ 2.0.54 nhánh |
| 09/08/2006 | CaoCVSS 10 | CVE-2006-4028 | ≤ 2.0.34 nhánh |
| 06/07/2006 | Trung bìnhCVSS 5 | CVE-2006-3389 | ≤ 2.0.3 |
| 06/07/2006 | Trung bìnhCVSS 5 | CVE-2006-3390 | ≤ 2.0.3 |
| 31/05/2006 | Trung bìnhCVSS 5 | CVE-2006-2702 | ≤ 2.0.2 |
| 30/05/2006 | CaoCVSS 7.5 | CVE-2006-2667 | ≤ 2.0.2 |
| 17/04/2006 | Trung bìnhCVSS 6.8 | CVE-2006-1796 | ≤ 2.017 nhánh |
| 19/03/2006 | Trung bìnhCVSS 4.3 | CVE-2006-1263 | ≤ 2.0.114 nhánh |
| 06/03/2006 | CaoCVSS 7.5 | CVE-2006-1012 | ≤ 1.5.2 |
| 03/03/2006 | Trung bìnhCVSS 4.3 | CVE-2006-0985 | ≤ 2.0.110 nhánh |
| 03/03/2006 | Trung bìnhCVSS 5 | CVE-2006-0986 | ≤ 2.0.110 nhánh |
| 16/02/2006 | ThấpCVSS 2.6 | CVE-2006-0733 | ≤ 2.0 |
| 21/12/2005 | Trung bìnhCVSS 5 | CVE-2005-4463 | ≤ 2.0.19 nhánh |
| 17/08/2005 | CaoCVSS 7.5 | CVE-2005-2612 | ≤ 1.5.1.38 nhánh |
| 05/07/2005 | Trung bìnhCVSS 4.3 | CVE-2005-2107 | ≤ 1.5.1.27 nhánh |
| 05/07/2005 | CaoCVSS 7.5 | CVE-2005-2108 | ≤ 1.5.1.27 nhánh |
| 05/07/2005 | Trung bìnhCVSS 5 | CVE-2005-2109 | ≤ 1.5.1.27 nhánh |
| 05/07/2005 | Trung bìnhCVSS 5 | CVE-2005-2110 | ≤ 1.5.1.27 nhánh |
| 01/06/2005 | CaoCVSS 7.5 | CVE-2005-1810 | ≤ 1.5.1 |
| 20/05/2005 | CaoCVSS 7.5 | CVE-2005-1687 | ≤ 1.5 |
| 20/05/2005 | Trung bìnhCVSS 5.3 | CVE-2005-1688 | ≤ 1.5 |
| 02/05/2005 | Trung bìnhCVSS 6.8 | CVE-2005-1102 | ≤ 1.5 |
| 31/12/2004 | Trung bìnhCVSS 4.3 | CVE-2004-1559 | ≤ 1.2 |
| 31/12/2004 | Trung bìnhCVSS 5 | CVE-2004-1584 | ≤ 1.2 |
Danh sách CVE từ NVD (dữ liệu công của chính phủ Mỹ); trạng thái từng bản từ WordPress.org. NVD có thể chậm hoặc ghi thiếu bản vá đã chuyển về nhánh cũ; khi hai nguồn khác nhau, WordPress.org đúng. Trang này chỉ gồm lõi WordPress; phần lớn lỗ hổng WordPress nằm ở plugin và theme.