WordPress security vulnerabilities
351 WordPress core vulnerabilities with version ranges, newest first; those reaching only releases before 5.0 are folded at the end. Updated 2026-10-31.
The safe release of each branch
WordPress backports security fixes to older branches. On any branch, its last release is enough (per WordPress.org).
- 7.1.4latest
- 7.0.8
- 6.9.11
- 6.8.12
- 6.7.11
- 6.6.11
- 6.5.14
- 6.4.14
- 6.3.14
- 6.2.15
- 6.1.16
- 6.0.18
- 5.9.20
- 5.8.19
- 5.7.21
- 5.6.23
- 5.5.24
- 5.4.25
- 5.3.27
- 5.2.30
- 5.1.28
- 5.0.31
- 4.9.35
- 4.8.34
- 4.7.39
| Published | Severity | CVE | Summary | Up to |
|---|---|---|---|---|
| 2026-09-22 | HighCVSS 8.1 | CVE-2026-87902 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE. | < 7.1.225 branches |
| 2026-07-17 | ModerateCVSS 5.9 | CVE-2026-60137 | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter. | < 7.0.23 branches |
| 2026-07-17 | CriticalCVSS 9.8 | CVE-2026-63030 | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution. | < 7.0.22 branches |
| 2024-10-16 | ModerateCVSS 4.9 | CVE-2022-4973 | WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page. | ≤ 6.0.2 |
| 2024-05-03 | HighCVSS 7.2 | CVE-2024-4439 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, | ≤ 6.5.16 branches |
| 2024-04-04 | HighCVSS 7.6 | CVE-2024-31210 | WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins -> Add New -> Upload Plugin screen in WordPress. If FTP credentials are requested for installation (in order to move the file into place outside of the `uploads` directory) then the uploaded file remains temporary av | < 6.4.324 branches |
| 2024-04-04 | ModerateCVSS 5.5 | CVE-2024-31211 | WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected. | < 6.4.2 |
| 2023-10-16 | ModerateCVSS 5.3 | CVE-2023-5561 | WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack | < 6.3.217 branches |
| 2023-10-13 | ModerateCVSS 6.5 | CVE-2023-38000 | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions. | ≤ 6.3.15 branches |
| 2023-10-13 | ModerateCVSS 4.3 | CVE-2023-39999 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0 th | < 6.3.223 branches |
| 2023-05-17 | ModerateCVSS 5.4 | CVE-2023-2745 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack. | ≤ 6.222 branches |
| 2023-01-05 | ModerateCVSS 5.3 | CVE-2023-22622 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on in | ≤ 6.1.1 |
| 2022-12-14 | ModerateCVSS 5.9 | CVE-2022-3590 | WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden. | ≤ 6.1.12 branches |
| 2022-12-05 | ModerateCVSS 6.1 | CVE-2022-43497 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. | < 6.0.324 branches |
| 2022-12-05 | ModerateCVSS 6.1 | CVE-2022-43500 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. | < 6.0.324 branches |
| 2022-12-05 | ModerateCVSS 5.3 | CVE-2022-43504 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7. | < 6.0.324 branches |
| 2022-01-06 | HighCVSS 8 | CVE-2022-21661 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. W | < 5.8.322 branches |
| 2022-01-06 | HighCVSS 8 | CVE-2022-21662 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go bac | < 5.8.3 |
| 2022-01-06 | ModerateCVSS 6.6 | CVE-2022-21663 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object injection. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly re | < 5.8.3 |
| 2022-01-06 | HighCVSS 7.4 | CVE-2022-21664 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of the classes, there's potential for unintended SQL queries to be executed. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 4.1.34. We strongly recommend that you | < 5.8.3 |
| 2021-11-25 | HighCVSS 8.1 | CVE-2021-44223 | WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory. | < 5.8 |
| 2021-09-09 | ModerateCVSS 5.3 | CVE-2021-39200 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of the function wp_die() can be leaked under certain conditions, which can include data like nonces. It can then be used to perform actions on your behalf. This has been patched in WordPress 5.8.1, along with any older affected versions via mino | < 5.8.1 |
| 2021-09-09 | HighCVSS 7.6 | CVE-2021-39201 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authenticated but low-privileged user (like contributor/author) to execute XSS in the editor. This bypasses the restrictions imposed on users who do not have the permission to post `unfiltered_html`. ### Patches This has been patched in WordPress | < 5.8 |
| 2021-09-09 | HighCVSS 7.6 | CVE-2021-39202 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta pha | ≤ 5.82 branches |
| 2021-09-09 | ModerateCVSS 6.8 | CVE-2021-39203 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated users who don't have permission to view private post types/data can bypass restrictions in the block editor under certain conditions. This affected WordPress 5.8 beta during the testing period. It's fixed in the final 5.8 release. | ≤ 5.8 |
| 2021-04-28 | CriticalCVSS 9.8 | CVE-2020-36326 | PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment exp | < 5.7.221 branches |
| 2021-04-15 | HighCVSS 7.1 | CVE-2021-29447 | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. W | < 5.7.1 |
| 2021-04-15 | ModerateCVSS 6.5 | CVE-2021-29450 | Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases. It's strongly recommended that you keep auto-updates enabled to receive the fix. | < 5.7.1 |
| 2020-11-02 | CriticalCVSS 9.8 | CVE-2020-28032 | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. | < 5.5.2 |
| 2020-11-02 | HighCVSS 7.5 | CVE-2020-28033 | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. | < 5.5.2 |
| 2020-11-02 | ModerateCVSS 6.1 | CVE-2020-28034 | WordPress before 5.5.2 allows XSS associated with global variables. | < 5.5.2 |
| 2020-11-02 | CriticalCVSS 9.8 | CVE-2020-28035 | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. | < 5.5.2 |
| 2020-11-02 | CriticalCVSS 9.8 | CVE-2020-28036 | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. | < 5.5.2 |
| 2020-11-02 | CriticalCVSS 9.8 | CVE-2020-28037 | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation). | < 5.5.2 |
| 2020-11-02 | ModerateCVSS 6.1 | CVE-2020-28038 | WordPress before 5.5.2 allows stored XSS via post slugs. | < 5.5.2 |
| 2020-11-02 | CriticalCVSS 9.1 | CVE-2020-28039 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected. | < 5.5.2 |
| 2020-11-02 | ModerateCVSS 4.3 | CVE-2020-28040 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. | < 5.5.2 |
| 2020-09-13 | ModerateCVSS 5.3 | CVE-2020-25286 | In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public. | < 5.4.2 |
| 2020-06-12 | ModerateCVSS 5.4 | CVE-2020-4046 | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. This has been patched in version 5.4.2, along with all the previously affected versions via a minor | < 5.4.218 branches |
| 2020-06-12 | ModerateCVSS 6.8 | CVE-2020-4047 | In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a higher privileged user when the file is viewed by them. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5 | < 5.4.218 branches |
| 2020-06-12 | ModerateCVSS 5.7 | CVE-2020-4048 | In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, 4.9.15, 4.8.14, 4.7.18, 4.6.19, 4.5.22, 4.4.23, 4.3.24, 4.2.28, 4.1.31, | < 5.4.218 branches |
| 2020-06-12 | LowCVSS 2.4 | CVE-2020-4049 | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1.6, 5.0.10, | < 5.4.218 branches |
| 2020-06-12 | LowCVSS 3.5 | CVE-2020-4050 | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in version 5.4.2, along with all the previously affected versions via a minor release (5.3.4, 5.2.7, 5.1 | < 5.4.218 branches |
| 2020-04-30 | ModerateCVSS 5.8 | CVE-2020-11025 | In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.2 | < 5.4.1 |
| 2020-04-30 | HighCVSS 8.7 | CVE-2020-11026 | In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4. | ≤ 5.418 branches |
| 2020-04-30 | ModerateCVSS 6.1 | CVE-2020-11027 | In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5. | ≤ 5.418 branches |
| 2020-04-30 | ModerateCVSS 5.8 | CVE-2020-11028 | In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.3 | < 5.4.1 |
| 2020-04-30 | ModerateCVSS 5.8 | CVE-2020-11029 | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3 | ≤ 5.418 branches |
| 2020-04-30 | ModerateCVSS 6.4 | CVE-2020-11030 | In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, | < 5.4.1 |
| 2019-12-27 | CriticalCVSS 9.8 | CVE-2019-20041 | wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring. | < 5.3.1 |
| 2019-12-27 | ModerateCVSS 6.1 | CVE-2019-20042 | In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. | < 5.3.1 |
| 2019-12-27 | ModerateCVSS 4.3 | CVE-2019-20043 | In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous Word | < 5.3.1 |
| 2019-12-26 | ModerateCVSS 5.8 | CVE-2019-16780 | WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 | < 5.3.12 branches |
| 2019-12-26 | ModerateCVSS 5.8 | CVE-2019-16781 | In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS. | < 5.3.1 |
| 2019-10-17 | CriticalCVSS 9.8 | CVE-2019-17669 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters. | < 5.2.4 |
| 2019-10-17 | CriticalCVSS 9.8 | CVE-2019-17670 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs. | < 5.2.4 |
| 2019-10-17 | ModerateCVSS 5.3 | CVE-2019-17671 | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled. | < 5.2.4 |
| 2019-10-17 | ModerateCVSS 6.1 | CVE-2019-17672 | WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements. | < 5.2.4 |
| 2019-10-17 | HighCVSS 7.5 | CVE-2019-17673 | WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header. | < 5.2.4 |
| 2019-10-17 | ModerateCVSS 5.4 | CVE-2019-17674 | WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer. | < 5.2.4 |
| 2019-10-17 | HighCVSS 8.8 | CVE-2019-17675 | WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF. | < 5.2.4 |
| 2019-09-11 | ModerateCVSS 6.1 | CVE-2019-16217 | WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. | < 5.2.3 |
| 2019-09-11 | ModerateCVSS 6.1 | CVE-2019-16218 | WordPress before 5.2.3 allows XSS in stored comments. | < 5.2.3 |
| 2019-09-11 | ModerateCVSS 6.1 | CVE-2019-16219 | WordPress before 5.2.3 allows XSS in shortcode previews. | < 5.2.3 |
| 2019-09-11 | ModerateCVSS 6.1 | CVE-2019-16220 | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash. | < 5.2.3 |
| 2019-09-11 | ModerateCVSS 6.1 | CVE-2019-16221 | WordPress before 5.2.3 allows reflected XSS in the dashboard. | < 5.2.3 |
| 2019-09-11 | ModerateCVSS 6.1 | CVE-2019-16222 | WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks. | < 5.2.3 |
| 2019-09-11 | ModerateCVSS 5.4 | CVE-2019-16223 | WordPress before 5.2.3 allows XSS in post previews by authenticated users. | < 5.2.3 |
| 2019-03-14 | HighCVSS 8.8 | CVE-2019-9787 | WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related | < 5.1.1 |
| 2019-02-20 | HighCVSS 8.8 | CVE-2019-8942 | WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943. | ≤ 5.010 branches |
| 2019-02-20 | ModerateCVSS 6.5 | CVE-2019-8943 | WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring. | ≤ 5.0.3 |
| 2018-12-14 | ModerateCVSS 6.5 | CVE-2018-20147 | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files. | < 5.0.12 branches |
| 2018-12-14 | CriticalCVSS 9.8 | CVE-2018-20148 | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php. | < 5.0.12 branches |
| 2018-12-14 | ModerateCVSS 5.4 | CVE-2018-20149 | In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data. | < 5.0.12 branches |
| 2018-12-14 | ModerateCVSS 6.1 | CVE-2018-20150 | In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins. | < 5.0.12 branches |
| 2018-12-14 | HighCVSS 7.5 | CVE-2018-20151 | In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default. | < 5.0.12 branches |
| 2018-12-14 | ModerateCVSS 6.5 | CVE-2018-20152 | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input. | < 5.0.12 branches |
| 2018-12-14 | ModerateCVSS 5.4 | CVE-2018-20153 | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS. | < 5.0.12 branches |
| 2018-11-16 | HighCVSS 8.8 | CVE-2018-19296 | PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack. | ≤ 5.7 |
272 vulnerabilities that only reach releases before 5.0 (a concern only for sites still on WordPress 4.x or older)
| Published | Severity | CVE | Up to |
|---|---|---|---|
| 2022-04-18 | ModerateCVSS 6.5 | CVE-2011-1762 | < 3.1.22 branches |
| 2019-05-22 | ModerateCVSS 5.3 | CVE-2017-6514 | ≤ 4.7.2 |
| 2018-09-06 | HighCVSS 8.8 | CVE-2017-1000600 | < 4.9 |
| 2018-09-06 | HighCVSS 8.8 | CVE-2018-1000773 | ≤ 4.9.8 |
| 2018-08-10 | HighCVSS 7.2 | CVE-2018-14028 | ≤ 4.9.7 |
| 2018-06-26 | HighCVSS 8.8 | CVE-2018-12895 | < 4.9.7 |
| 2018-04-16 | ModerateCVSS 6.1 | CVE-2018-10100 | < 4.9.5 |
| 2018-04-16 | ModerateCVSS 6.1 | CVE-2018-10101 | < 4.9.5 |
| 2018-04-16 | ModerateCVSS 6.1 | CVE-2018-10102 | < 4.9.5 |
| 2018-04-12 | HighCVSS 8.1 | CVE-2014-6412 | < 4.4.0 |
| 2018-02-06 | HighCVSS 7.5 | CVE-2018-6389 | ≤ 4.9.2 |
| 2018-01-18 | ModerateCVSS 6.1 | CVE-2018-5776 | < 4.9.2 |
| 2017-12-02 | HighCVSS 8.8 | CVE-2017-17091 | ≤ 4.9 |
| 2017-12-02 | ModerateCVSS 5.4 | CVE-2017-17092 | < 4.9.1 |
| 2017-12-02 | ModerateCVSS 5.4 | CVE-2017-17093 | < 4.9.1 |
| 2017-12-02 | ModerateCVSS 5.4 | CVE-2017-17094 | < 4.9.1 |
| 2017-11-02 | CriticalCVSS 9.8 | CVE-2017-16510 | ≤ 4.8.2 |
| 2017-10-19 | HighCVSS 7.5 | CVE-2012-6707 | ≤ 4.8.2 |
| 2017-10-12 | ModerateCVSS 4.7 | CVE-2016-9263 | ≤ 4.8.2 |
| 2017-10-03 | ModerateCVSS 6.5 | CVE-2017-14990 | ≤ 4.8.2 |
| 2017-09-23 | ModerateCVSS 6.1 | CVE-2017-14718 | ≤ 4.8.1 |
| 2017-09-23 | HighCVSS 7.5 | CVE-2017-14719 | ≤ 4.8.1202 branches |
| 2017-09-23 | ModerateCVSS 6.1 | CVE-2017-14720 | ≤ 4.8.1 |
| 2017-09-23 | ModerateCVSS 6.1 | CVE-2017-14721 | ≤ 4.8.1 |
| 2017-09-23 | HighCVSS 7.5 | CVE-2017-14722 | ≤ 4.8.18 branches |
| 2017-09-23 | CriticalCVSS 9.8 | CVE-2017-14723 | ≤ 4.8.1 |
| 2017-09-23 | ModerateCVSS 6.1 | CVE-2017-14724 | ≤ 4.8.1 |
| 2017-09-23 | ModerateCVSS 5.4 | CVE-2017-14725 | ≤ 4.8.1 |
| 2017-09-23 | ModerateCVSS 6.1 | CVE-2017-14726 | ≤ 4.8.1 |
| 2017-05-18 | ModerateCVSS 6.1 | CVE-2017-9061 | ≤ 4.7.4 |
| 2017-05-18 | HighCVSS 8.6 | CVE-2017-9062 | ≤ 4.7.4 |
| 2017-05-18 | ModerateCVSS 6.1 | CVE-2017-9063 | ≤ 4.7.4 |
| 2017-05-18 | HighCVSS 8.8 | CVE-2017-9064 | ≤ 4.7.4 |
| 2017-05-18 | HighCVSS 7.5 | CVE-2017-9065 | ≤ 4.7.4 |
| 2017-05-18 | HighCVSS 8.6 | CVE-2017-9066 | ≤ 4.7.4 |
| 2017-05-04 | ModerateCVSS 5.9 | CVE-2017-8295 | ≤ 4.7.4 |
| 2017-04-03 | HighCVSS 7.5 | CVE-2017-1001000 | ≤ 4.7.23 branches |
| 2017-03-12 | ModerateCVSS 5.4 | CVE-2017-6814 | ≤ 4.7.2 |
| 2017-03-12 | ModerateCVSS 6.1 | CVE-2017-6815 | ≤ 4.7.2 |
| 2017-03-12 | ModerateCVSS 4.9 | CVE-2017-6816 | ≤ 4.7.2 |
| 2017-03-12 | ModerateCVSS 5.4 | CVE-2017-6817 | ≤ 4.7.2 |
| 2017-03-12 | ModerateCVSS 6.1 | CVE-2017-6818 | ≤ 4.7.2 |
| 2017-03-12 | ModerateCVSS 6.5 | CVE-2017-6819 | ≤ 4.7.2 |
| 2017-01-30 | ModerateCVSS 5.3 | CVE-2017-5610 | ≤ 4.7.1 |
| 2017-01-30 | CriticalCVSS 9.8 | CVE-2017-5611 | ≤ 4.7.1 |
| 2017-01-30 | ModerateCVSS 6.1 | CVE-2017-5612 | ≤ 4.7.1 |
| 2017-01-18 | ModerateCVSS 4.3 | CVE-2016-10148 | ≤ 4.5.5 |
| 2017-01-18 | HighCVSS 7.1 | CVE-2016-6896 | ≤ 4.5.3 |
| 2017-01-18 | ModerateCVSS 6.5 | CVE-2016-6897 | ≤ 4.5.5 |
| 2017-01-15 | ModerateCVSS 5.3 | CVE-2017-5487 | ≤ 4.7 |
| 2017-01-15 | ModerateCVSS 6.1 | CVE-2017-5488 | ≤ 4.7 |
| 2017-01-15 | HighCVSS 8.8 | CVE-2017-5489 | ≤ 4.7 |
| 2017-01-15 | ModerateCVSS 6.1 | CVE-2017-5490 | ≤ 4.7 |
| 2017-01-15 | ModerateCVSS 5.3 | CVE-2017-5491 | ≤ 4.7 |
| 2017-01-15 | HighCVSS 8.8 | CVE-2017-5492 | ≤ 4.7 |
| 2017-01-15 | HighCVSS 7.5 | CVE-2017-5493 | ≤ 4.7 |
| 2017-01-05 | ModerateCVSS 4.8 | CVE-2016-7168 | ≤ 4.6 |
| 2017-01-05 | ModerateCVSS 6.3 | CVE-2016-7169 | ≤ 4.6 |
| 2016-12-30 | CriticalCVSS 9.8 | CVE-2016-10033 | ≤ 4.7 |
| 2016-12-30 | CriticalCVSS 9.8 | CVE-2016-10045 | ≤ 4.7 |
| 2016-08-07 | HighCVSS 8.6 | CVE-2016-4029 | < 4.5 |
| 2016-08-07 | ModerateCVSS 6.1 | CVE-2016-6634 | ≤ 4.4.4 |
| 2016-08-07 | HighCVSS 8.8 | CVE-2016-6635 | ≤ 4.4.2 |
| 2016-06-29 | HighCVSS 7.5 | CVE-2016-5832 | ≤ 4.5.2 |
| 2016-06-29 | ModerateCVSS 6.1 | CVE-2016-5833 | ≤ 4.5.2 |
| 2016-06-29 | ModerateCVSS 6.1 | CVE-2016-5834 | ≤ 4.5.2 |
| 2016-06-29 | HighCVSS 7.5 | CVE-2016-5835 | ≤ 4.5.2 |
| 2016-06-29 | HighCVSS 7.5 | CVE-2016-5836 | ≤ 4.5.2 |
| 2016-06-29 | HighCVSS 7.5 | CVE-2016-5837 | ≤ 4.5.2 |
| 2016-06-29 | HighCVSS 7.5 | CVE-2016-5838 | ≤ 4.5.2 |
| 2016-06-29 | HighCVSS 7.5 | CVE-2016-5839 | ≤ 4.5.2 |
| 2016-05-22 | ModerateCVSS 6.1 | CVE-2015-5714 | ≤ 4.3.0 |
| 2016-05-22 | ModerateCVSS 4.3 | CVE-2015-5715 | ≤ 4.3.0 |
| 2016-05-22 | ModerateCVSS 5.4 | CVE-2015-7989 | ≤ 4.3.0 |
| 2016-05-22 | ModerateCVSS 6.1 | CVE-2015-8834 | ≤ 4.2.1 |
| 2016-05-22 | ModerateCVSS 6.1 | CVE-2016-1564 | ≤ 4.4.0 |
| 2016-05-22 | HighCVSS 7.4 | CVE-2016-2221 | ≤ 4.4.1 |
| 2016-05-22 | HighCVSS 8.6 | CVE-2016-2222 | ≤ 4.4.1 |
| 2016-05-22 | ModerateCVSS 6.1 | CVE-2016-4566 | ≤ 4.5.1 |
| 2016-05-22 | ModerateCVSS 6.1 | CVE-2016-4567 | ≤ 4.5.1 |
| 2015-11-09 | HighCVSS 7.5 | CVE-2015-2213 | ≤ 4.2.3 |
| 2015-11-09 | ModerateCVSS 5 | CVE-2015-5730 | ≤ 4.2.3 |
| 2015-11-09 | ModerateCVSS 6.8 | CVE-2015-5731 | ≤ 4.2.3 |
| 2015-11-09 | ModerateCVSS 4.3 | CVE-2015-5732 | ≤ 4.2.3 |
| 2015-11-09 | ModerateCVSS 4.3 | CVE-2015-5733 | ≤ 4.2.3 |
| 2015-11-09 | ModerateCVSS 4.3 | CVE-2015-5734 | ≤ 4.2.3 |
| 2015-08-05 | ModerateCVSS 4.3 | CVE-2015-3438 | ≤ 4.1.1 |
| 2015-08-05 | ModerateCVSS 4.3 | CVE-2015-3439 | ≤ 4.1.18 branches |
| 2015-08-03 | ModerateCVSS 4.3 | CVE-2015-3440 | ≤ 4.2 |
| 2015-08-03 | LowCVSS 3.5 | CVE-2015-5622 | ≤ 4.2.2 |
| 2015-08-03 | ModerateCVSS 4 | CVE-2015-5623 | ≤ 4.2.2 |
| 2014-11-25 | ModerateCVSS 4.3 | CVE-2014-9031 | ≤ 3.9.29 branches |
| 2014-11-25 | ModerateCVSS 4.3 | CVE-2014-9032 | ≤ 4.04 branches |
| 2014-11-25 | ModerateCVSS 6.8 | CVE-2014-9033 | ≤ 4.04 branches |
| 2014-11-25 | ModerateCVSS 5 | CVE-2014-9034 | ≤ 4.010 branches |
| 2014-11-25 | ModerateCVSS 4.3 | CVE-2014-9035 | ≤ 4.010 branches |
| 2014-11-25 | ModerateCVSS 4.3 | CVE-2014-9036 | ≤ 4.010 branches |
| 2014-11-25 | ModerateCVSS 6.8 | CVE-2014-9037 | ≤ 4.010 branches |
| 2014-11-25 | ModerateCVSS 6.4 | CVE-2014-9038 | ≤ 4.010 branches |
| 2014-11-25 | ModerateCVSS 4.3 | CVE-2014-9039 | ≤ 4.010 branches |
| 2014-10-27 | HighCVSS 7.5 | CVE-2003-1599 | ≤ 0.70 |
| 2014-10-01 | HighCVSS 7.5 | CVE-2003-1598 | ≤ 0.7 |
| 2014-08-18 | HighCVSS 7.5 | CVE-2014-5203 | ≤ 3.9.12 branches |
| 2014-08-18 | ModerateCVSS 6.8 | CVE-2014-5204 | ≤ 3.9.12 branches |
| 2014-08-18 | ModerateCVSS 6.8 | CVE-2014-5205 | ≤ 3.9.12 branches |
| 2014-08-18 | LowCVSS 2.1 | CVE-2014-5240 | ≤ 3.9.132 branches |
| 2014-08-18 | ModerateCVSS 5 | CVE-2014-5265 | ≤ 3.9.132 branches |
| 2014-08-18 | ModerateCVSS 5 | CVE-2014-5266 | ≤ 3.9.132 branches |
| 2014-04-10 | ModerateCVSS 4 | CVE-2014-0165 | ≤ 3.8.198 branches |
| 2014-04-10 | ModerateCVSS 6.4 | CVE-2014-0166 | ≤ 3.8.198 branches |
| 2014-01-21 | ModerateCVSS 5.8 | CVE-2010-5293 | ≤ 3.0.148 branches |
| 2014-01-21 | ModerateCVSS 4.3 | CVE-2010-5294 | ≤ 3.0.148 branches |
| 2014-01-21 | ModerateCVSS 4.3 | CVE-2010-5295 | ≤ 3.0.148 branches |
| 2014-01-21 | ModerateCVSS 4.9 | CVE-2010-5296 | ≤ 3.0.148 branches |
| 2014-01-21 | LowCVSS 2.1 | CVE-2010-5297 | ≤ 3.047 branches |
| 2014-01-21 | ModerateCVSS 4 | CVE-2011-5270 | ≤ 3.0.56 branches |
| 2014-01-21 | ModerateCVSS 4.3 | CVE-2012-6633 | ≤ 3.3.218 branches |
| 2014-01-21 | ModerateCVSS 6.4 | CVE-2012-6634 | ≤ 3.3.218 branches |
| 2014-01-21 | ModerateCVSS 4 | CVE-2012-6635 | ≤ 3.3.218 branches |
| 2013-12-30 | ModerateCVSS 6.8 | CVE-2013-7233 | ≤ 2.0.1111 branches |
| 2013-09-12 | HighCVSS 7.5 | CVE-2013-4338 | ≤ 3.6 |
| 2013-09-12 | HighCVSS 7.5 | CVE-2013-4339 | ≤ 3.6 |
| 2013-09-12 | LowCVSS 3.5 | CVE-2013-4340 | ≤ 3.6 |
| 2013-09-12 | ModerateCVSS 4.3 | CVE-2013-5738 | ≤ 3.6 |
| 2013-09-12 | LowCVSS 3.5 | CVE-2013-5739 | ≤ 3.6 |
| 2013-07-19 | ModerateCVSS 4.3 | CVE-2012-3414 | ≤ 3.3.116 branches |
| 2013-07-08 | ModerateCVSS 6.4 | CVE-2013-0235 | ≤ 3.5.076 branches |
| 2013-07-08 | ModerateCVSS 4.3 | CVE-2013-0236 | ≤ 3.5.076 branches |
| 2013-07-08 | ModerateCVSS 4.3 | CVE-2013-0237 | ≤ 3.5.076 branches |
| 2013-07-08 | ModerateCVSS 4.3 | CVE-2013-2199 | ≤ 3.5.177 branches |
| 2013-07-08 | ModerateCVSS 4 | CVE-2013-2200 | ≤ 3.5.177 branches |
| 2013-07-08 | ModerateCVSS 4.3 | CVE-2013-2201 | ≤ 3.5.177 branches |
| 2013-07-08 | ModerateCVSS 4.3 | CVE-2013-2202 | ≤ 3.5.177 branches |
| 2013-07-08 | ModerateCVSS 4.3 | CVE-2013-2203 | ≤ 3.5.177 branches |
| 2013-07-08 | ModerateCVSS 4.3 | CVE-2013-2204 | ≤ 3.5.177 branches |
| 2013-07-08 | ModerateCVSS 4.3 | CVE-2013-2205 | ≤ 3.5.177 branches |
| 2013-06-21 | ModerateCVSS 4.3 | CVE-2013-2173 | ≤ 3.5.1 |
| 2012-12-27 | LowCVSS 2.6 | CVE-2012-5868 | ≤ 3.4.2 |
| 2012-09-28 | ModerateCVSS 6.8 | CVE-2012-4448 | ≤ 3.4.2 |
| 2012-09-14 | ModerateCVSS 6.5 | CVE-2010-5106 | ≤ 3.0.270 branches |
| 2012-09-14 | ModerateCVSS 4 | CVE-2012-4421 | ≤ 3.4.187 branches |
| 2012-09-14 | LowCVSS 3.5 | CVE-2012-4422 | ≤ 3.4.188 branches |
| 2012-07-22 | LowCVSS 2.6 | CVE-2012-3383 | ≤ 3.4.0 |
| 2012-07-22 | ModerateCVSS 6.8 | CVE-2012-3384 | ≤ 3.4.085 branches |
| 2012-07-22 | ModerateCVSS 5 | CVE-2012-3385 | ≤ 3.4.085 branches |
| 2012-06-27 | ModerateCVSS 4.3 | CVE-2011-4956 | ≤ 3.175 branches |
| 2012-06-27 | ModerateCVSS 5 | CVE-2011-4957 | ≤ 3.175 branches |
| 2012-05-03 | ModerateCVSS 6.8 | CVE-2012-1936 | ≤ 3.3.183 branches |
| 2012-04-21 | HighCVSS 10 | CVE-2012-2399 | ≤ 3.3.180 branches |
| 2012-04-21 | HighCVSS 10 | CVE-2012-2400 | ≤ 3.3.180 branches |
| 2012-04-21 | ModerateCVSS 5 | CVE-2012-2401 | ≤ 3.3.180 branches |
| 2012-04-21 | ModerateCVSS 5.5 | CVE-2012-2402 | ≤ 3.3.180 branches |
| 2012-04-21 | ModerateCVSS 4.3 | CVE-2012-2403 | ≤ 3.3.180 branches |
| 2012-04-21 | ModerateCVSS 4.3 | CVE-2012-2404 | ≤ 3.3.180 branches |
| 2012-01-30 | ModerateCVSS 5 | CVE-2011-4898 | ≤ 3.3.173 branches |
| 2012-01-30 | HighCVSS 7.5 | CVE-2011-4899 | ≤ 3.3.173 branches |
| 2012-01-30 | ModerateCVSS 4.3 | CVE-2012-0782 | ≤ 3.3.173 branches |
| 2012-01-30 | ModerateCVSS 5 | CVE-2012-0937 | ≤ 3.3.173 branches |
| 2012-01-06 | LowCVSS 2.6 | CVE-2012-0287 | ≤ 3.3 |
| 2011-09-24 | ModerateCVSS 5 | CVE-2011-3818 | ≤ 3.0.42 branches |
| 2011-08-10 | HighCVSS 10 | CVE-2011-3122 | ≤ 3.24 branches |
| 2011-08-10 | HighCVSS 10 | CVE-2011-3125 | ≤ 3.24 branches |
| 2011-08-10 | ModerateCVSS 5 | CVE-2011-3126 | ≤ 3.24 branches |
| 2011-08-10 | ModerateCVSS 5.8 | CVE-2011-3127 | ≤ 3.24 branches |
| 2011-08-10 | ModerateCVSS 5 | CVE-2011-3128 | ≤ 3.24 branches |
| 2011-08-10 | HighCVSS 9.3 | CVE-2011-3129 | ≤ 3.24 branches |
| 2011-08-10 | HighCVSS 7.5 | CVE-2011-3130 | ≤ 3.24 branches |
| 2011-03-14 | LowCVSS 3.5 | CVE-2011-0700 | ≤ 3.0.4 |
| 2011-03-14 | ModerateCVSS 4 | CVE-2011-0701 | ≤ 3.0.4 |
| 2011-01-03 | ModerateCVSS 4.3 | CVE-2010-4536 | ≤ 3.0.3 |
| 2010-12-07 | ModerateCVSS 6 | CVE-2010-4257 | ≤ 3.0.1 |
| 2010-02-23 | ModerateCVSS 4 | CVE-2010-0682 | ≤ 2.9.14 branches |
| 2009-11-17 | ModerateCVSS 6 | CVE-2009-3890 | ≤ 2.8.5 |
| 2009-11-17 | LowCVSS 3.5 | CVE-2009-3891 | ≤ 2.8.5 |
| 2009-10-23 | ModerateCVSS 4.3 | CVE-2009-3622 | ≤ 2.8.4 |
| 2009-08-18 | ModerateCVSS 4.3 | CVE-2009-2851 | ≤ 2.8.1 |
| 2009-08-18 | HighCVSS 10 | CVE-2009-2853 | ≤ 2.8.257 branches |
| 2009-08-18 | ModerateCVSS 6.4 | CVE-2009-2854 | ≤ 2.8.2 |
| 2009-08-13 | HighCVSS 7.5 | CVE-2009-2762 | ≤ 2.8.3 |
| 2009-07-10 | ModerateCVSS 4.9 | CVE-2009-2334 | ≤ 2.7.180 branches |
| 2009-07-10 | ModerateCVSS 5 | CVE-2009-2335 | < 2.8.1 |
| 2009-07-10 | ModerateCVSS 5 | CVE-2009-2336 | < 2.8.1 |
| 2009-07-10 | ModerateCVSS 5 | CVE-2009-2431 | ≤ 2.7.1 |
| 2009-07-10 | ModerateCVSS 5 | CVE-2009-2432 | ≤ 2.7.180 branches |
| 2009-04-28 | ModerateCVSS 4.3 | CVE-2008-6762 | ≤ 2.6 |
| 2009-04-28 | HighCVSS 10 | CVE-2008-6767 | ≤ 2.6 |
| 2008-12-19 | HighCVSS 8.5 | CVE-2008-5695 | ≤ 2.3.2 |
| 2008-11-28 | ModerateCVSS 4.3 | CVE-2008-5278 | ≤ 2.6.374 branches |
| 2008-11-17 | ModerateCVSS 4 | CVE-2008-5113 | ≤ 2.6.3 |
| 2008-10-30 | HighCVSS 10 | CVE-2008-4796 | < 2.6.3 |
| 2008-10-28 | HighCVSS 9.3 | CVE-2008-4769 | ≤ 2.568 branches |
| 2008-09-18 | ModerateCVSS 5.1 | CVE-2008-4106 | ≤ 2.6.134 branches |
| 2008-08-27 | HighCVSS 7.5 | CVE-2008-3747 | ≤ 2.645 branches |
| 2008-07-18 | ModerateCVSS 4.3 | CVE-2008-3233 | ≤ 2.5.154 branches |
| 2008-05-21 | HighCVSS 9 | CVE-2008-2392 | ≤ 2.5.1 |
| 2008-05-12 | HighCVSS 7.5 | CVE-2008-2146 | ≤ 2.2.247 branches |
| 2008-05-02 | ModerateCVSS 4.3 | CVE-2008-2068 | ≤ 2.5 |
| 2008-04-28 | HighCVSS 7.5 | CVE-2008-1930 | ≤ 2.5 |
| 2008-03-12 | ModerateCVSS 4.3 | CVE-2008-1304 | ≤ 2.3.2 |
| 2008-02-08 | ModerateCVSS 6.4 | CVE-2008-0664 | ≤ 2.3.238 branches |
| 2008-01-10 | ModerateCVSS 5 | CVE-2008-0191 | ≤ 2.32 branches |
| 2008-01-10 | ModerateCVSS 4.3 | CVE-2008-0192 | ≤ 2.0.9 |
| 2008-01-10 | ModerateCVSS 4.3 | CVE-2008-0193 | ≤ 2.315 branches |
| 2008-01-10 | HighCVSS 7.5 | CVE-2008-0194 | ≤ 2.0.3 |
| 2008-01-10 | ModerateCVSS 5 | CVE-2008-0195 | ≤ 2.0.11 |
| 2008-01-10 | ModerateCVSS 5 | CVE-2008-0196 | ≤ 2.0.11 |
| 2007-12-12 | ModerateCVSS 6.8 | CVE-2007-6318 | ≤ 2.3.124 branches |
| 2007-11-19 | CriticalCVSS 9.8 | CVE-2007-6013 | ≤ 2.3.1 |
| 2007-10-30 | LowCVSS 2.6 | CVE-2007-5710 | ≤ 2.3 |
| 2007-09-26 | ModerateCVSS 4.3 | CVE-2007-5105 | ≤ 2.0.12 branches |
| 2007-09-26 | ModerateCVSS 4.3 | CVE-2007-5106 | ≤ 2.0 |
| 2007-09-14 | ModerateCVSS 4.3 | CVE-2007-4893 | ≤ 2.2.231 branches |
| 2007-09-14 | HighCVSS 7.5 | CVE-2007-4894 | ≤ 2.2.231 branches |
| 2007-08-03 | ModerateCVSS 4.3 | CVE-2007-4139 | ≤ 2.2.1 |
| 2007-08-03 | LowCVSS 2.1 | CVE-2007-4153 | ≤ 2.2.1 |
| 2007-08-03 | ModerateCVSS 6.5 | CVE-2007-4154 | ≤ 2.2.1 |
| 2007-07-10 | ModerateCVSS 4 | CVE-2007-3639 | ≤ 2.2.1 |
| 2007-07-03 | ModerateCVSS 6 | CVE-2007-3543 | ≤ 2.2.0 |
| 2007-07-03 | ModerateCVSS 6.5 | CVE-2007-3544 | ≤ 2.2.0 |
| 2007-06-15 | ModerateCVSS 6 | CVE-2007-3238 | ≤ 2.2 |
| 2007-06-15 | ModerateCVSS 4.3 | CVE-2007-3239 | ≤ 2.2 |
| 2007-06-15 | ModerateCVSS 4.3 | CVE-2007-3240 | ≤ 2.2 |
| 2007-06-15 | ModerateCVSS 4.3 | CVE-2007-3241 | ≤ 2.2 |
| 2007-06-08 | ModerateCVSS 6.5 | CVE-2007-3140 | ≤ 2.2 |
| 2007-05-22 | HighCVSS 7.5 | CVE-2007-2821 | ≤ 2.1.3 |
| 2007-04-09 | ModerateCVSS 4.9 | CVE-2007-1893 | ≤ 2.1.2 |
| 2007-04-09 | ModerateCVSS 4.3 | CVE-2007-1894 | ≤ 2.1.212 branches |
| 2007-04-09 | ModerateCVSS 6.5 | CVE-2007-1897 | ≤ 2.1.23 branches |
| 2007-03-28 | LowCVSS 3.5 | CVE-2007-1732 | ≤ 2.1.2 |
| 2007-03-23 | ModerateCVSS 4.3 | CVE-2007-1622 | ≤ 2.1.214 branches |
| 2007-03-22 | ModerateCVSS 6.5 | CVE-2007-1599 | ≤ 2.1.2 |
| 2007-03-10 | ModerateCVSS 5 | CVE-2007-1409 | ≤ 2.1.110 branches |
| 2007-03-05 | HighCVSS 7.5 | CVE-2007-1277 | ≤ 2.1.1 |
| 2007-03-03 | ModerateCVSS 6.8 | CVE-2007-1244 | ≤ 2.1.1 |
| 2007-03-02 | ModerateCVSS 5.8 | CVE-2007-1230 | ≤ 2.1 |
| 2007-02-21 | ModerateCVSS 4.3 | CVE-2007-1049 | ≤ 2.0.720 branches |
| 2007-01-29 | HighCVSS 7.8 | CVE-2007-0539 | ≤ 2.0 |
| 2007-01-29 | ModerateCVSS 5 | CVE-2007-0540 | ≤ 2.0 |
| 2007-01-29 | ModerateCVSS 5 | CVE-2007-0541 | ≤ 2.0 |
| 2007-01-16 | HighCVSS 7.8 | CVE-2007-0262 | ≤ 2.12 branches |
| 2007-01-13 | HighCVSS 7.5 | CVE-2007-0233 | ≤ 2.0.619 branches |
| 2007-01-09 | ModerateCVSS 6.8 | CVE-2007-0106 | ≤ 2.0.56 branches |
| 2007-01-09 | ModerateCVSS 6.8 | CVE-2007-0107 | ≤ 2.0.5 |
| 2007-01-09 | ModerateCVSS 5 | CVE-2007-0109 | ≤ 2.0.56 branches |
| 2006-12-28 | ModerateCVSS 6.8 | CVE-2006-6808 | ≤ 2.0.518 branches |
| 2006-11-21 | ModerateCVSS 6.5 | CVE-2006-6016 | ≤ 2.0.4 |
| 2006-11-21 | ModerateCVSS 6.5 | CVE-2006-6017 | ≤ 2.0.5 |
| 2006-11-04 | ModerateCVSS 6 | CVE-2006-5705 | ≤ 2.0.43 branches |
| 2006-09-13 | ModerateCVSS 5 | CVE-2006-4743 | ≤ 2.0.54 branches |
| 2006-08-09 | HighCVSS 10 | CVE-2006-4028 | ≤ 2.0.34 branches |
| 2006-07-06 | ModerateCVSS 5 | CVE-2006-3389 | ≤ 2.0.3 |
| 2006-07-06 | ModerateCVSS 5 | CVE-2006-3390 | ≤ 2.0.3 |
| 2006-05-31 | ModerateCVSS 5 | CVE-2006-2702 | ≤ 2.0.2 |
| 2006-05-30 | HighCVSS 7.5 | CVE-2006-2667 | ≤ 2.0.2 |
| 2006-04-17 | ModerateCVSS 6.8 | CVE-2006-1796 | ≤ 2.017 branches |
| 2006-03-19 | ModerateCVSS 4.3 | CVE-2006-1263 | ≤ 2.0.114 branches |
| 2006-03-06 | HighCVSS 7.5 | CVE-2006-1012 | ≤ 1.5.2 |
| 2006-03-03 | ModerateCVSS 4.3 | CVE-2006-0985 | ≤ 2.0.110 branches |
| 2006-03-03 | ModerateCVSS 5 | CVE-2006-0986 | ≤ 2.0.110 branches |
| 2006-02-16 | LowCVSS 2.6 | CVE-2006-0733 | ≤ 2.0 |
| 2005-12-21 | ModerateCVSS 5 | CVE-2005-4463 | ≤ 2.0.19 branches |
| 2005-08-17 | HighCVSS 7.5 | CVE-2005-2612 | ≤ 1.5.1.38 branches |
| 2005-07-05 | ModerateCVSS 4.3 | CVE-2005-2107 | ≤ 1.5.1.27 branches |
| 2005-07-05 | HighCVSS 7.5 | CVE-2005-2108 | ≤ 1.5.1.27 branches |
| 2005-07-05 | ModerateCVSS 5 | CVE-2005-2109 | ≤ 1.5.1.27 branches |
| 2005-07-05 | ModerateCVSS 5 | CVE-2005-2110 | ≤ 1.5.1.27 branches |
| 2005-06-01 | HighCVSS 7.5 | CVE-2005-1810 | ≤ 1.5.1 |
| 2005-05-20 | HighCVSS 7.5 | CVE-2005-1687 | ≤ 1.5 |
| 2005-05-20 | ModerateCVSS 5.3 | CVE-2005-1688 | ≤ 1.5 |
| 2005-05-02 | ModerateCVSS 6.8 | CVE-2005-1102 | ≤ 1.5 |
| 2004-12-31 | ModerateCVSS 4.3 | CVE-2004-1559 | ≤ 1.2 |
| 2004-12-31 | ModerateCVSS 5 | CVE-2004-1584 | ≤ 1.2 |
CVEs from NVD (US-government public data); each release's status from WordPress.org. NVD can lag or miss backported fixes; where the two differ, WordPress.org is right. This page covers WordPress core only; most WordPress vulnerabilities are in plugins and themes.