Wordpress
573 CVEs across 55 Wordpress products. Browse Wordpress vulnerabilities, severities, and proof-of-concept exploits.
Wordpress products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-64638 | | 2026-08-07 | WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an at… | |
CVE-2026-45293 | High | 8.6 | 2026-07-28 | WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.Enqu… |
CVE-2026-63030 | Critical | 9.8 | 2026-07-17 | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Q… |
CVE-2026-60137 | Medium | 5.9 | 2026-07-17 | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow… |
CVE-2020-37233 | Medium | 6.4 | 2026-05-16 | WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers with moderator privileges to inj… |
CVE-2023-54333 | High | 8.2 | 2026-01-13 | Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries. At… |
CVE-2025-58674 | Medium | 5.9 | 2025-09-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows Stored XSS. WordPress core security team… |
CVE-2025-58246 | Medium | 4.3 | 2025-09-23 | Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware… |
CVE-2025-54352 | Low | 3.7 | 2025-07-21 | WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not ch… |
CVE-2022-4973 | Medium | 4.9 | 2024-10-16 | WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress… |
CVE-2024-8914 | High | 7.2 | 2024-09-25 | The Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam plugin for WordPress is vulnerable to Stored Cross-Site Scripting in… |
CVE-2024-4439 | High | 7.2 | 2024-05-03 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient outp… |
CVE-2024-31211 | Medium | 5.5 | 2024-04-04 | WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()… |
CVE-2024-31210 | High | 7.6 | 2024-04-04 | WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administra… |
CVE-2023-5561 | Medium | 5.3 | 2023-10-16 | WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of us… |
CVE-2023-39999 | Medium | 4.3 | 2023-10-13 | Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through… |
CVE-2023-38000 | Medium | 6.5 | 2023-10-13 | Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from… |
CVE-2013-10027 | Medium | 4.3 | 2023-06-04 | A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/restart of t… |
CVE-2022-47174 | Medium | 4.3 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <= 2.2.0 versions. |
CVE-2022-47161 | Medium | 4.3 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions. |
CVE-2023-2745 | Medium | 5.4 | 2023-05-17 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers t… |
CVE-2013-10021 | Low | 3.5 | 2023-03-11 | A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function… |
CVE-2023-22622 | Medium | 5.3 | 2023-01-05 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes… |
CVE-2022-3590 | Medium | 5.9 | 2022-12-14 | WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP r… |
CVE-2022-43504 | Medium | 5.3 | 2022-12-05 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who… |
CVE-2022-43500 | Medium | 6.1 | 2022-12-05 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer a… |
CVE-2022-43497 | Medium | 6.1 | 2022-12-05 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer a… |
CVE-2011-1762 | Medium | 6.5 | 2022-04-18 | A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user wi… |
CVE-2022-21664 | High | 7.4 | 2022-01-06 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of t… |
CVE-2022-21663 | Medium | 6.6 | 2022-01-06 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role ca… |
CVE-2022-21662 | High | 8.0 | 2022-01-06 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like autho… |
CVE-2022-21661 | High | 8.0 | 2022-01-06 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, ther… |
CVE-2021-44223 | High | 8.1 | 2021-11-25 | WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain att… |
CVE-2021-39203 | Medium | 6.8 | 2021-09-09 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authenticated us… |
CVE-2021-39202 | High | 7.6 | 2021-09-09 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets edit… |
CVE-2021-39201 | High | 7.6 | 2021-09-09 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows an authen… |
CVE-2021-39200 | Medium | 5.3 | 2021-09-09 | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output data of t… |
CVE-2020-36326 | Critical | 9.8 | 2021-04-28 | PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-192… |
CVE-2021-29476 | Critical | 9.8 | 2021-04-27 | Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1… |
CVE-2021-29450 | Medium | 6.5 | 2021-04-15 | Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requ… |
CVE-2021-29447 | High | 7.1 | 2021-04-15 | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE… |
CVE-2020-28040 | Medium | 4.3 | 2020-11-02 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. |
CVE-2020-28039 | Critical | 9.1 | 2020-11-02 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is… |
CVE-2020-28038 | Medium | 6.1 | 2020-11-02 | WordPress before 5.5.2 allows stored XSS via post slugs. |
CVE-2020-28037 | Critical | 9.8 | 2020-11-02 | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an att… |
CVE-2020-28036 | Critical | 9.8 | 2020-11-02 | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. |
CVE-2020-28035 | Critical | 9.8 | 2020-11-02 | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. |
CVE-2020-28034 | Medium | 6.1 | 2020-11-02 | WordPress before 5.5.2 allows XSS associated with global variables. |
CVE-2020-28033 | High | 7.5 | 2020-11-02 | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. |
CVE-2020-28032 | Critical | 9.8 | 2020-11-02 | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. |
CVE-2020-26596 | High | 8.8 | 2020-10-07 | The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Ed… |
CVE-2020-25286 | Medium | 5.3 | 2020-09-13 | In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or… |
CVE-2020-4050 | Low | 3.5 | 2020-06-12 | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an ad… |
CVE-2020-4049 | Low | 2.4 | 2020-06-12 | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-a… |
CVE-2020-4048 | Medium | 5.7 | 2020-06-12 | In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to uninten… |
CVE-2020-4047 | Medium | 6.8 | 2020-06-12 | In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pag… |
CVE-2020-4046 | Medium | 5.4 | 2020-06-12 | In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML… |
CVE-2020-11030 | Medium | 6.4 | 2020-04-30 | In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This… |
CVE-2020-11029 | Medium | 5.8 | 2020-04-30 | In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) at… |
CVE-2020-11028 | Medium | 5.8 | 2020-04-30 | In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of condition… |
CVE-2020-11027 | Medium | 6.1 | 2020-04-30 | In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email… |
CVE-2020-11026 | High | 8.7 | 2020-04-30 | In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file… |
CVE-2020-11025 | Medium | 5.8 | 2020-04-30 | In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Ex… |
CVE-2019-20043 | Medium | 4.3 | 2019-12-27 | In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a… |
CVE-2019-20042 | Medium | 6.1 | 2019-12-27 | In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site s… |
CVE-2019-20041 | Critical | 9.8 | 2019-12-27 | wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization… |
CVE-2019-16781 | Medium | 5.8 | 2019-12-26 | In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed with… |
CVE-2019-16780 | Medium | 5.8 | 2019-12-26 | WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the… |
CVE-2019-17675 | High | 8.8 | 2019-10-17 | WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF. |
CVE-2019-17674 | Medium | 5.4 | 2019-10-17 | WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer. |
CVE-2019-17673 | High | 7.5 | 2019-10-17 | WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header. |
CVE-2019-17672 | Medium | 6.1 | 2019-10-17 | WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements. |
CVE-2019-17671 | Medium | 5.3 | 2019-10-17 | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled. |
CVE-2019-17670 | Critical | 9.8 | 2019-10-17 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs. |
CVE-2019-17669 | Critical | 9.8 | 2019-10-17 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series… |
CVE-2019-16223 | Medium | 5.4 | 2019-09-11 | WordPress before 5.2.3 allows XSS in post previews by authenticated users. |
CVE-2019-16222 | Medium | 6.1 | 2019-09-11 | WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) atta… |
CVE-2019-16221 | Medium | 6.1 | 2019-09-11 | WordPress before 5.2.3 allows reflected XSS in the dashboard. |
CVE-2019-16220 | Medium | 6.1 | 2019-09-11 | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provid… |
CVE-2019-16219 | Medium | 6.1 | 2019-09-11 | WordPress before 5.2.3 allows XSS in shortcode previews. |
CVE-2019-16218 | Medium | 6.1 | 2019-09-11 | WordPress before 5.2.3 allows XSS in stored comments. |
CVE-2019-16217 | Medium | 6.1 | 2019-09-11 | WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. |
CVE-2017-6514 | Medium | 5.3 | 2019-05-22 | WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/… |
CVE-2019-9787 | High | 8.8 | 2019-03-14 | WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occ… |
CVE-2019-8943 | Medium | 6.5 | 2019-02-20 | WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary… |
CVE-2019-8942 | High | 8.8 | 2019-02-20 | WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, su… |
CVE-2018-20153 | Medium | 5.4 | 2018-12-14 | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS. |
CVE-2018-20152 | Medium | 6.5 | 2018-12-14 | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input. |
CVE-2018-20151 | High | 7.5 | 2018-12-14 | In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen… |
CVE-2018-20150 | Medium | 6.1 | 2018-12-14 | In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins. |
CVE-2018-20149 | Medium | 5.4 | 2018-12-14 | In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrict… |
CVE-2018-20148 | Critical | 9.8 | 2018-12-14 | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call… |
CVE-2018-20147 | Medium | 6.5 | 2018-12-14 | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files. |
CVE-2018-19296 | High | 8.8 | 2018-11-16 | PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack. |
CVE-2018-1000773 | High | 8.8 | 2018-09-06 | WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an… |
CVE-2017-1000600 | High | 8.8 | 2018-09-06 | WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears t… |
CVE-2018-14028 | High | 7.2 | 2018-08-10 | In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploa… |
CVE-2018-12895 | High | 8.8 | 2018-06-26 | WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is pass… |
CVE-2018-10102 | Medium | 6.1 | 2018-04-16 | Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag. |
CVE-2018-10101 | Medium | 6.1 | 2018-04-16 | Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server. |