Advisories · Technology

WordPress.

Every CVE that names WordPress among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-119977 CVE record

CVSS 8.1 HighCritical · KEVKEV

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
- WordPress
- Race condition
Not analysed yet 31 Oct 2026
CVE-2026-114570 CVE record

CVSS 4.9 Medium

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
- WordPress
- Cross-site scripting (XSS)
Not analysed yet 22 Oct 2026
CVE-2026-87902 CVE record

CVSS 8.1 HighCritical · KEV, CVSS 7+ and EPSSKEV

PHP file inclusion in WordPress
- WordPress
- File inclusion
Not analysed yet 22 Sept 2026
CVE-2026-65640 CVE record

CVSS 8.8 High

Unrestricted file upload in WordPress
- WordPress
- Unrestricted file upload
Not analysed yet 17 Aug 2026
CVE-2026-64638 CVE record

CVSS 8.9 High

Cross-site scripting in WordPress
- WordPress
- Cross-site scripting (XSS)
Not analysed yet 7 Aug 2026
CVE-2026-63030 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
- WordPress
- CWE-436
Not analysed yet 17 Jul 2026
CVE-2026-60137 CVE record

CVSS 5.9 MediumCritical · KEVKEV

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
- WordPress
- SQL injection
Not analysed yet 17 Jul 2026
CVE-2026-3906 CVE record

CVSS 4.3 Medium

WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API
- WordPress
- Broken access control
Not analysed yet 11 Mar 2026
CVE-2025-58674 CVE record

CVSS 5.9 Medium

WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability
- WordPress
- Cross-site scripting (XSS)
Not analysed yet 23 Sept 2025
CVE-2025-58246 CVE record

CVSS 4.3 Medium

WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability
- WordPress
- Information disclosure
Not analysed yet 23 Sept 2025
CVE-2025-54352 CVE record

CVSS 3.7 Low

WordPress: WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft…
- WordPress
- CWE-669
Not analysed yet 21 Jul 2025
CVE-2022-4973 CVE record

CVSS 4.9 Medium

WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function
- WordPress
- Cross-site scripting (XSS)
Not analysed yet 16 Oct 2024
CVE-2024-6307 CVE record

CVSS 6.4 Medium

WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API
- WordPress
Not analysed yet 25 Jun 2024
CVE-2024-4439 CVE record

CVSS 7.2 HighCritical · CVSS 7+ and EPSS

Cross-site scripting in WordPress
- WordPress
- Cross-site scripting (XSS)
Not analysed yet 3 May 2024
CVE-2023-5692 CVE record

CVSS 5.3 Medium

WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink
- WordPress
- Information disclosure
Not analysed yet 5 Apr 2024
CVE-2023-5561 CVE record

CVSS 5.3 Medium

WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
- WordPress
Not analysed yet 16 Oct 2023
CVE-2023-39999 CVE record

CVSS 4.3 Medium

WordPress < 6.3.2 is vulnerable to Broken Access Control
- WordPress
- Information disclosure
Not analysed yet 13 Oct 2023
CVE-2023-38000 CVE record

CVSS 6.5 Medium

Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block
- WordPress
- Gutenberg
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2023
CVE-2023-2745 CVE record

CVSS 5.4 Medium

WordPress Core < 6.2.1 - Directory Traversal
- WordPress
- Path traversal
Not analysed yet 17 May 2023
CVE-2022-3590 CVE record

CVSS 5.9 Medium

WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding
- WordPress
Not analysed yet 14 Dec 2022
CVE-2022-43504 CVE record

CVSS 5.3 Medium

Improper authentication in WordPress
- WordPress
- Authentication bypass
Not analysed yet 5 Dec 2022
CVE-2022-43500 CVE record

CVSS 6.1 Medium

Cross-site scripting in WordPress
- WordPress
- Cross-site scripting (XSS)
Not analysed yet 5 Dec 2022
CVE-2022-43497 CVE record

CVSS 6.1 Medium

Cross-site scripting in WordPress
- WordPress
- Cross-site scripting (XSS)
Not analysed yet 5 Dec 2022
CVE-2011-1762 CVE record

Improper access control in wordpress
- wordpress
- Broken access control
Not analysed yet 18 Apr 2022
CVE-2020-11026 CVE record

CVSS 8.7 High

Specially crafted filenames in WordPress leading to XSS
- WordPress
- CWE-707
Not analysed yet 30 Apr 2020
CVE-2020-11028 CVE record

CVSS 5.8 Medium

Unauthenticated disclosure of certain private posts in WordPress
- WordPress
- Broken access control
Not analysed yet 30 Apr 2020
CVE-2020-11029 CVE record

CVSS 5.8 Medium

Cross-site scripting in stats method (object cache) in WordPress
- WordPress
- Cross-site scripting (XSS)
Not analysed yet 30 Apr 2020
CVE-2020-11030 CVE record

CVSS 6.4 Medium

Cross-site scripting (XSS) in Search block in WordPress
- WordPress
- CWE-707
Not analysed yet 30 Apr 2020
CVE-2020-11025 CVE record

CVSS 5.8 Medium

Authenticated cross-site scripting (XSS) in WordPress Customizer
- WordPress
- Cross-site scripting (XSS)
Not analysed yet 30 Apr 2020
CVE-2020-11027 CVE record

CVSS 6.1 Medium

Password reset links invalidation issue in WordPress
- WordPress
- CWE-672
Not analysed yet 30 Apr 2020
CVE-2019-16781 CVE record

CVSS 5.8 Medium

Stored cross-site scripting (XSS) in WordPress block editor
- WordPress
- Cross-site scripting (XSS)
Not analysed yet 26 Dec 2019
CVE-2019-16780 CVE record

CVSS 5.8 Medium

Stored cross-site scripting (XSS) in WordPress block editor
- WordPress
- Cross-site scripting (XSS)
Not analysed yet 26 Dec 2019