WordPress Foundation WordPress
6 CVEs affecting WordPress Foundation WordPress. Latest disclosed: 2026-03-11. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4439 | High | 7.2 | 2024-05-03 | WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient outp… |
CVE-2024-6307 | Medium | 6.4 | 2024-06-25 | WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and outp… |
CVE-2023-2745 | Medium | 5.4 | 2023-05-17 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers t… |
CVE-2023-5692 | Medium | 5.3 | 2024-04-05 | WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can… |
CVE-2022-4973 | Medium | 4.9 | 2024-10-16 | WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress… |
CVE-2026-3906 | Medium | 4.3 | 2026-03-11 | WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in… |