WordPress Vulnerabilities

Version released on 2013-12-12

Download tar

Download zip

2022-10-17

WP < 6.0.3 - Stored XSS via wp-mail.php

Fixed in version 3.8.40

2022-10-17

WP < 6.0.3 - Open Redirect via wp_nonce_ays

Fixed in version 3.8.40

2022-10-17

WP < 6.0.3 - Email Address Disclosure via wp-mail.php

Fixed in version 3.8.40

2022-10-17

WP < 6.0.3 - Reflected XSS via SQLi in Media Library

Fixed in version 3.8.40

2022-10-17

WP < 6.0.3 - CSRF in wp-trackback.php

Fixed in version 3.8.40

2022-10-17

WP < 6.0.3 - Stored XSS via the Customizer

Fixed in version 3.8.40

2022-10-17

WP < 6.0.3 - Stored XSS via Comment Editing

Fixed in version 3.8.40

2022-10-17

WP < 6.0.3 - Content from Multipart Emails Leaked

Fixed in version 3.8.40

2022-10-17

WP < 6.0.3 - SQLi in WP_Date_Query

Fixed in version 3.8.40

2022-10-17

WP < 6.0.3 - Stored XSS via RSS Widget

Fixed in version 3.8.40

2022-10-17

WP < 6.0.3 - Data Exposure via REST Terms/Tags Endpoint

Fixed in version 3.8.40

2022-10-17

WP < 6.0.3 - Multiple Stored XSS via Gutenberg

Fixed in version 3.8.40

2022-08-30

WP < 6.0.2 - Reflected Cross-Site Scripting

Fixed in version 3.8.39

2022-08-30

WP < 6.0.2 - Authenticated Stored Cross-Site Scripting

Fixed in version 3.8.39

2022-08-30

WP < 6.0.2 - SQLi via Link API

Fixed in version 3.8.39

2022-03-11

WordPress < 5.9.2 - Prototype Pollution in jQuery

Fixed in version 3.8.38

2022-01-06

WordPress < 5.8.3 - SQL Injection via WP_Query

Fixed in version 3.8.37

2022-01-06

WordPress < 5.8.3 - Author+ Stored XSS via Post Slugs

Fixed in version 3.8.37

2022-01-06

WordPress < 5.8.3 - Super Admin Object Injection in Multisites

Fixed in version 3.8.37

2021-11-25

WordPress < 5.8 - Plugin Confusion

Fixed in version 5.8

2021-05-13

WordPress 3.7 to 5.7.1 - Object Injection in PHPMailer

Fixed in version 3.8.36

2020-06-11

WordPress < 5.4.2 - Authenticated XSS via Media Files

Fixed in version 3.8.34

2020-06-11

WordPress < 5.4.2 - Open Redirection

Fixed in version 3.8.34

2020-06-11

WordPress < 5.4.2 - Authenticated Stored XSS via Theme Upload

Fixed in version 3.8.34

2020-06-11

WordPress < 5.4.2 - Misuse of set-screen-option Leading to Privilege Escalation

Fixed in version 3.8.34

2020-06-11

WordPress < 5.4.2 - Disclosure of Password-Protected Page/Post Comments

Fixed in version 3.8.34

2020-04-29

WordPress < 5.4.1 - Password Reset Tokens Failed to Be Properly Invalidated

Fixed in version 3.8.33

2020-04-29

WordPress < 5.4.1 - Unauthenticated Users View Private Posts

Fixed in version 3.8.33

2020-04-29

WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in Customizer

Fixed in version 3.8.33

2020-04-29

WordPress < 5.4.1 - Cross-Site Scripting (XSS) in wp-object-cache

Fixed in version 3.8.33

2020-04-29

WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in File Uploads

Fixed in version 3.8.33

2020-01-21

WordPress <= 5.2.3 - Hardening Bypass

Fixed in version 3.8.31

2019-12-13

WordPress <= 5.3 - Authenticated Improper Access Controls in REST API

Fixed in version 3.8.32

2019-12-13

WordPress <= 5.3 - Authenticated Stored XSS via Crafted Links

Fixed in version 3.8.32

2019-12-13

WordPress <= 5.3 - Authenticated Stored XSS via Block Editor Content

Fixed in version 3.8.32

2019-12-13

WordPress <= 5.3 - wp_kses_bad_protocol() Colon Bypass

Fixed in version 3.8.32

2019-10-14

WordPress <= 5.2.3 - Stored XSS in Customizer

Fixed in version 3.8.31

2019-10-14

WordPress <= 5.2.3 - Unauthenticated View Private/Draft Posts

Fixed in version 3.8.31

2019-10-14

WordPress <= 5.2.3 - Stored XSS in Style Tags

Fixed in version 3.8.31

2019-10-14

WordPress <= 5.2.3 - JSON Request Cache Poisoning

Fixed in version 3.8.31

2019-10-14

WordPress <= 5.2.3 - Server-Side Request Forgery (SSRF) in URL Validation

Fixed in version 3.8.31

2019-10-14

WordPress <= 5.2.3 - Admin Referrer Validation

Fixed in version 3.8.31

2019-09-05

WordPress <= 5.2.2 - Cross-Site Scripting (XSS) in URL Sanitisation

Fixed in version 3.8.30

2019-02-19

WordPress 3.7-5.0 (except 4.9.9) - Authenticated Code Execution

Fixed in version 5.0.1

2018-12-13

WordPress <= 5.0 - Authenticated File Delete

Fixed in version 3.8.28

2018-12-13

WordPress <= 5.0 - Authenticated Post Type Bypass

Fixed in version 3.8.28

2018-12-13

WordPress <= 5.0 - PHP Object Injection via Meta Data

Fixed in version 3.8.28

2018-12-13

WordPress <= 5.0 - Authenticated Cross-Site Scripting (XSS)

Fixed in version 3.8.28

2018-12-13

WordPress <= 5.0 - Cross-Site Scripting (XSS) that could affect plugins

Fixed in version 3.8.28

2018-12-13

WordPress <= 5.0 - User Activation Screen Search Engine Indexing

Fixed in version 3.8.28

2018-12-13

WordPress <= 5.0 - File Upload to XSS on Apache Web Servers

Fixed in version 3.8.28

2018-06-27

WordPress <= 4.9.6 - Authenticated Arbitrary File Deletion

Fixed in version 4.9.7

2018-04-03

WordPress 3.7-4.9.4 - Remove localhost Default

Fixed in version 3.8.26

2018-04-03

WordPress 3.7-4.9.4 - Use Safe Redirect for Login

Fixed in version 3.8.26

2018-04-03

WordPress 3.7-4.9.4 - Escape Version in Generator Tag

Fixed in version 3.8.26

2018-02-05

WordPress <= 4.9.4 - Application Denial of Service (DoS) (unpatched)

No known fix

2018-01-17

WordPress 3.7-4.9.1 - MediaElement Cross-Site Scripting (XSS)

Fixed in version 3.8.25

2017-11-29

WordPress 2.8.6-4.9 - Authenticated JavaScript File Upload

Fixed in version 3.8.24

2017-11-29

WordPress 1.5.0-4.9 - RSS and Atom Feed Escaping

Fixed in version 3.8.24

2017-11-29

WordPress 3.7-4.9 - 'newbloguser' Key Weak Hashing

Fixed in version 3.8.24

2017-10-31

WordPress <= 4.8.2 - $wpdb->prepare() Weakness

Fixed in version 3.8.23

2017-09-20

WordPress 2.9.2-4.8.1 - Open Redirect

Fixed in version 3.8.22

2017-09-20

WordPress 3.0-4.8.1 - Path Traversal in Unzipping

Fixed in version 3.8.22

2017-09-19

WordPress 2.3.0-4.8.1 - $wpdb->prepare() potential SQL Injection

Fixed in version 3.8.22

2017-08-24

WordPress 2.3.0-4.7.4 - Authenticated SQL injection

Fixed in version 4.7.5

2017-05-16

WordPress 2.7.0-4.7.4 - Insufficient Redirect Validation

Fixed in version 3.8.21

2017-05-16

WordPress 2.5.0-4.7.4 - Post Meta Data Values Improper Handling in XML-RPC

Fixed in version 3.8.21

2017-05-16

WordPress 3.4.0-4.7.4 - XML-RPC Post Meta Data Lack of Capability Checks

Fixed in version 3.8.21

2017-05-16

WordPress 2.5.0-4.7.4 - Filesystem Credentials Dialog CSRF

Fixed in version 3.8.21

2017-05-16

WordPress 3.3-4.7.4 - Large File Upload Error XSS

Fixed in version 3.8.21

2017-05-16

WordPress 3.4.0-4.7.4 - Customizer XSS & CSRF

Fixed in version 3.8.21

2017-05-03

WordPress 2.3-4.8.3 - Host Header Injection in Password Reset

No known fix

2017-03-06

WordPress 3.6.0-4.7.2 - Authenticated Cross-Site Scripting (XSS) via Media File Metadata

Fixed in version 3.8.19

2017-03-06

WordPress 2.8.1-4.7.2 - Control Characters in Redirect URL Validation

Fixed in version 4.7.3

2017-01-26

WordPress 3.5-4.7.1 - WP_Query SQL Injection

Fixed in version 3.8.18

2017-01-11

WordPress 2.9-4.7 - Authenticated Cross-Site scripting (XSS) in update-core.php

Fixed in version 3.8.17

2017-01-11

WordPress 3.4-4.7 - Stored Cross-Site Scripting (XSS) via Theme Name fallback

Fixed in version 3.8.17

2017-01-11

WordPress <= 4.7 - Post via Email Checks mail.example.com by Default

Fixed in version 3.8.17

2017-01-11

WordPress 2.8-4.7 - Accessibility Mode Cross-Site Request Forgery (CSRF)

Fixed in version 3.8.17

2017-01-11

WordPress 3.0-4.7 - Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Fixed in version 3.8.17

2016-09-07

WordPress 2.5-4.6 - Authenticated Stored Cross-Site Scripting via Image Filename

Fixed in version 3.8.16

2016-09-07

WordPress 2.8-4.6 - Path Traversal in Upgrade Package Uploader

Fixed in version 3.8.16

2016-06-21

WordPress 3.6-4.5.2 - Authenticated Revision History Information Disclosure

Fixed in version 3.8.15

2016-06-21

WordPress 2.6.0-4.5.2 - Unauthorized Category Removal from Post

Fixed in version 3.8.15

2016-05-06

WordPress <= 4.5.1 - Pupload Same Origin Method Execution (SOME)

Fixed in version 3.8.14

2016-04-12

WordPress <= 4.4.2 - SSRF Bypass using Octal & Hexedecimal IP addresses

Fixed in version 4.5

2016-04-12

WordPress <= 4.4.2 - Reflected XSS in Network Settings

Fixed in version 4.5

2016-04-12

WordPress <= 4.4.2 - Script Compression Option CSRF

Fixed in version 4.5

2016-02-02

WordPress 3.7-4.4.1 - Local URIs Server Side Request Forgery (SSRF)

Fixed in version 3.8.13

2016-02-02

WordPress 3.7-4.4.1 - Open Redirect

Fixed in version 3.8.13

2016-01-06

WordPress 3.7-4.4 - Authenticated Cross-Site Scripting (XSS)

Fixed in version 3.8.12

2015-09-15

WordPress <= 4.3 - Authenticated Shortcode Tags Cross-Site Scripting (XSS)

Fixed in version 3.8.11

2015-09-15

WordPress <= 4.3 - User List Table Cross-Site Scripting (XSS)

Fixed in version 3.8.11

2015-09-15

WordPress <= 4.3 - Publish Post & Mark as Sticky Permission Issue

Fixed in version 3.8.11

2015-08-05

WordPress <= 4.2.3 - Timing Side Channel Attack

Fixed in version 3.8.10

2015-08-05

WordPress <= 4.2.3 - Widgets Title Cross-Site Scripting (XSS)

Fixed in version 3.8.10

2015-08-05

WordPress <= 4.2.3 - Nav Menu Title Cross-Site Scripting (XSS)

Fixed in version 3.8.10

2015-08-05

WordPress <= 4.2.3 - Legacy Theme Preview Cross-Site Scripting (XSS)

Fixed in version 3.8.10

2015-08-04

WordPress <= 4.2.3 - wp_untrash_post_comments SQL Injection

Fixed in version 3.8.10

2015-07-23

WordPress <= 4.2.2 - Authenticated Stored Cross-Site Scripting (XSS)

Fixed in version 3.8.9

2015-04-21

WordPress <= 4.1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)

Fixed in version 4.1.2

2014-11-30

WordPress <= 4.0 - Server Side Request Forgery (SSRF)

Fixed in version 4.0.1

2014-11-20

WordPress <= 4.0 - Long Password Denial of Service (DoS)

Fixed in version 4.0.1

2014-11-20

WordPress 3.0-3.9.2 - Unauthenticated Stored Cross-Site Scripting (XSS)

Fixed in version 4.0

2014-09-17

WordPress 3.4.2 - 3.9.2 Does Not Invalidate Sessions Upon Logout

Fixed in version 4.0

2014-09-16

WordPress 3.6 - 3.9.1 XXE in GetID3 Library

Fixed in version 3.9.2

2014-09-16

WordPress 3.0 - 3.9.1 Authenticated Cross-Site Scripting (XSS) in Multisite

Fixed in version 3.9.2

2014-09-16

WordPress 2.0.3 - 3.9.1 (except 3.7.4 / 3.8.4) CSRF Token Brute Forcing

Fixed in version 3.9.2

2014-08-27

WordPress 3.5-3.7.1 - XML-RPC Denial of Service

Fixed in version 3.9.2

2014-08-01

WordPress 3.7.1 & 3.8 - Cleartext Admin Credentials Disclosure

No known fix