Advisories · Technology

wordpress-develop.

Every CVE that names wordpress-develop among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2024-31211 CVE record

CVSS 5.5 Medium

Remote Code Execution in `WP_HTML_Token`
- wordpress-develop
- Insecure deserialization
Not analysed yet 4 Apr 2024
CVE-2024-31210 CVE record

CVSS 7.7 High

PHP file upload bypass via Plugin installer
- wordpress-develop
- Unrestricted file upload
Not analysed yet 4 Apr 2024
CVE-2022-21662 CVE record

CVSS 8.0 HighCritical · CVSS 7+ and EPSS

Stored XSS in WordPress
- wordpress-develop
- Cross-site scripting (XSS)
Not analysed yet 6 Jan 2022
CVE-2022-21663 CVE record

CVSS 6.6 Medium

Authenticated Object Injection in Multisites in WordPress
- wordpress-develop
- Other injection
Not analysed yet 6 Jan 2022
CVE-2022-21664 CVE record

CVSS 7.4 High

SQL injection in WordPress
- wordpress-develop
- SQL injection
Not analysed yet 6 Jan 2022
CVE-2022-21661 CVE record

CVSS 8.0 HighCritical · CVSS 7+ and EPSS

SQL injection in WordPress
- wordpress-develop
- SQL injection
Not analysed yet 6 Jan 2022
CVE-2021-39203 CVE record

CVSS 6.8 Medium

Private data disclosure/privilege escalation through the block editor in Wordpress
- wordpress-develop
- Information disclosure
Not analysed yet 9 Sept 2021
CVE-2021-39202 CVE record

CVSS 7.6 High

WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widget
- wordpress-develop
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2021
CVE-2021-39201 CVE record

CVSS 7.6 High

Authenticated cross-site scripting (XSS) in WordPress editor
- wordpress-develop
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2021
CVE-2021-39200 CVE record

CVSS 5.3 Medium

Information Disclosure in wp_die() via JSONP in wordpress
- wordpress-develop
- Information disclosure
Not analysed yet 9 Sept 2021
CVE-2021-29450 CVE record

CVSS 6.5 Medium

WordPress Authenticated disclosure of password-protected posts and pages
- wordpress-develop
- Information disclosure
Not analysed yet 15 Apr 2021
CVE-2021-29447 CVE record

CVSS 7.1 HighCritical · CVSS 7+ and EPSS

WordPress Authenticated XXE attack when installation is running PHP 8
- wordpress-develop
- XML external entities (XXE)
Not analysed yet 15 Apr 2021
CVE-2020-4047 CVE record

CVSS 6.8 Medium

Authenticated XSS via media attachment page in WordPress
- wordpress-develop
- Cross-site scripting (XSS)
Not analysed yet 12 Jun 2020
CVE-2020-4048 CVE record

CVSS 5.7 Medium

Open redirect in wp_validate_redirect() in WordPress
- wordpress-develop
- Open redirect
Not analysed yet 12 Jun 2020
CVE-2020-4049 CVE record

CVSS 2.4 Low

Authenticated self-XSS via theme uploads in WordPress
- wordpress-develop
- Cross-site scripting (XSS)
Not analysed yet 12 Jun 2020
CVE-2020-4050 CVE record

CVSS 3.5 Low

set-screen-option filter misuse by plugins leading to privilege escalation in WordPress
- wordpress-develop
- Authentication bypass
Not analysed yet 12 Jun 2020
CVE-2020-4046 CVE record

CVSS 5.4 Medium

Authenticated XSS through embed block in WordPress
- wordpress-develop
- Cross-site scripting (XSS)
Not analysed yet 12 Jun 2020