WPScan
How it worksPricing
Vulnerabilities
WordPressPluginsThemesStatsSubmit vulnerabilities
For developers
StatusAPI detailsCLI scanner
Contact

WordPress Vulnerabilities

WordPress 4.0 Vulnerabilities

Version released on 2014-09-04

downloadDownload tar
downloadDownload zip
2022-10-17
WP < 6.0.3 - Stored XSS via wp-mail.php
Fixed in version 4.0.37
2022-10-17
WP < 6.0.3 - Open Redirect via wp_nonce_ays
Fixed in version 4.0.37
2022-10-17
WP < 6.0.3 - Email Address Disclosure via wp-mail.php
Fixed in version 4.0.37
2022-10-17
WP < 6.0.3 - Reflected XSS via SQLi in Media Library
Fixed in version 4.0.37
2022-10-17
WP < 6.0.3 - CSRF in wp-trackback.php
Fixed in version 4.0.37
2022-10-17
WP < 6.0.3 - Stored XSS via the Customizer
Fixed in version 4.0.37
2022-10-17
WP < 6.0.3 - Stored XSS via Comment Editing
Fixed in version 4.0.37
2022-10-17
WP < 6.0.3 - Content from Multipart Emails Leaked
Fixed in version 4.0.37
2022-10-17
WP < 6.0.3 - SQLi in WP_Date_Query
Fixed in version 4.0.37
2022-10-17
WP < 6.0.3 - Stored XSS via RSS Widget
Fixed in version 4.0.37
2022-10-17
WP < 6.0.3 - Data Exposure via REST Terms/Tags Endpoint
Fixed in version 4.0.37
2022-10-17
WP < 6.0.3 - Multiple Stored XSS via Gutenberg
Fixed in version 4.0.37
2022-08-30
WP < 6.0.2 - Reflected Cross-Site Scripting
Fixed in version 4.0.36
2022-08-30
WP < 6.0.2 - Authenticated Stored Cross-Site Scripting
Fixed in version 4.0.36
2022-08-30
WP < 6.0.2 - SQLi via Link API
Fixed in version 4.0.36
2022-03-11
WordPress < 5.9.2 - Prototype Pollution in jQuery
Fixed in version 4.0.35
2022-01-06
WordPress < 5.8.3 - SQL Injection via WP_Query
Fixed in version 4.0.34
2022-01-06
WordPress < 5.8.3 - Author+ Stored XSS via Post Slugs
Fixed in version 4.0.34
2022-01-06
WordPress < 5.8.3 - Super Admin Object Injection in Multisites
Fixed in version 4.0.34
2021-11-25
WordPress < 5.8 - Plugin Confusion
Fixed in version 5.8
2021-05-13
WordPress 3.7 to 5.7.1 - Object Injection in PHPMailer
Fixed in version 4.0.33
2020-06-11
WordPress < 5.4.2 - Authenticated XSS via Media Files
Fixed in version 4.0.31
2020-06-11
WordPress < 5.4.2 - Open Redirection
Fixed in version 4.0.31
2020-06-11
WordPress < 5.4.2 - Authenticated Stored XSS via Theme Upload
Fixed in version 4.0.31
2020-06-11
WordPress < 5.4.2 - Misuse of set-screen-option Leading to Privilege Escalation
Fixed in version 4.0.31
2020-06-11
WordPress < 5.4.2 - Disclosure of Password-Protected Page/Post Comments
Fixed in version 4.0.31
2020-04-29
WordPress < 5.4.1 - Password Reset Tokens Failed to Be Properly Invalidated
Fixed in version 4.0.30
2020-04-29
WordPress < 5.4.1 - Unauthenticated Users View Private Posts
Fixed in version 4.0.30
2020-04-29
WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in Customizer
Fixed in version 4.0.30
2020-04-29
WordPress < 5.4.1 - Cross-Site Scripting (XSS) in wp-object-cache
Fixed in version 4.0.30
2020-04-29
WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in File Uploads
Fixed in version 4.0.30
2020-01-21
WordPress <= 5.2.3 - Hardening Bypass
Fixed in version 4.0.28
2019-12-13
WordPress <= 5.3 - Authenticated Improper Access Controls in REST API
Fixed in version 4.0.29
2019-12-13
WordPress <= 5.3 - Authenticated Stored XSS via Crafted Links
Fixed in version 4.0.29
2019-12-13
WordPress <= 5.3 - Authenticated Stored XSS via Block Editor Content
Fixed in version 4.0.29
2019-12-13
WordPress <= 5.3 - wp_kses_bad_protocol() Colon Bypass
Fixed in version 4.0.29
2019-10-14
WordPress <= 5.2.3 - Stored XSS in Customizer
Fixed in version 4.0.28
2019-10-14
WordPress <= 5.2.3 - Unauthenticated View Private/Draft Posts
Fixed in version 4.0.28
2019-10-14
WordPress <= 5.2.3 - Stored XSS in Style Tags
Fixed in version 4.0.28
2019-10-14
WordPress <= 5.2.3 - JSON Request Cache Poisoning
Fixed in version 4.0.28
2019-10-14
WordPress <= 5.2.3 - Server-Side Request Forgery (SSRF) in URL Validation
Fixed in version 4.0.28
2019-10-14
WordPress <= 5.2.3 - Admin Referrer Validation
Fixed in version 4.0.28
2019-09-05
WordPress <= 5.2.2 - Cross-Site Scripting (XSS) in URL Sanitisation
Fixed in version 4.0.27
2019-03-13
WordPress 3.9-5.1 - Comment Cross-Site Scripting (XSS)
Fixed in version 4.0.26
2019-02-19
WordPress 3.7-5.0 (except 4.9.9) - Authenticated Code Execution
Fixed in version 5.0.1
2018-12-13
WordPress <= 5.0 - Authenticated File Delete
Fixed in version 4.0.25
2018-12-13
WordPress <= 5.0 - Authenticated Post Type Bypass
Fixed in version 4.0.25
2018-12-13
WordPress <= 5.0 - PHP Object Injection via Meta Data
Fixed in version 4.0.25
2018-12-13
WordPress <= 5.0 - Authenticated Cross-Site Scripting (XSS)
Fixed in version 4.0.25
2018-12-13
WordPress <= 5.0 - Cross-Site Scripting (XSS) that could affect plugins
Fixed in version 4.0.25
2018-12-13
WordPress <= 5.0 - User Activation Screen Search Engine Indexing
Fixed in version 4.0.25
2018-12-13
WordPress <= 5.0 - File Upload to XSS on Apache Web Servers
Fixed in version 4.0.25
2018-06-27
WordPress <= 4.9.6 - Authenticated Arbitrary File Deletion
Fixed in version 4.0.24
2018-04-03
WordPress 3.7-4.9.4 - Remove localhost Default
Fixed in version 4.0.23
2018-04-03
WordPress 3.7-4.9.4 - Use Safe Redirect for Login
Fixed in version 4.0.23
2018-04-03
WordPress 3.7-4.9.4 - Escape Version in Generator Tag
Fixed in version 4.0.23
2018-02-05
WordPress <= 4.9.4 - Application Denial of Service (DoS) (unpatched)
No known fix
2018-01-17
WordPress 3.7-4.9.1 - MediaElement Cross-Site Scripting (XSS)
Fixed in version 4.0.22
2017-11-29
WordPress 2.8.6-4.9 - Authenticated JavaScript File Upload
Fixed in version 4.0.21
2017-11-29
WordPress 1.5.0-4.9 - RSS and Atom Feed Escaping
Fixed in version 4.0.21
2017-11-29
WordPress 3.7-4.9 - 'newbloguser' Key Weak Hashing
Fixed in version 4.0.21
2017-10-31
WordPress <= 4.8.2 - $wpdb->prepare() Weakness
Fixed in version 4.0.20
2017-09-20
WordPress 2.9.2-4.8.1 - Open Redirect
Fixed in version 4.0.19
2017-09-20
WordPress 3.0-4.8.1 - Path Traversal in Unzipping
Fixed in version 4.0.19
2017-09-19
WordPress 2.3.0-4.8.1 - $wpdb->prepare() potential SQL Injection
Fixed in version 4.0.19
2017-08-24
WordPress 2.3.0-4.7.4 - Authenticated SQL injection
Fixed in version 4.7.5
2017-05-16
WordPress 2.7.0-4.7.4 - Insufficient Redirect Validation
Fixed in version 4.0.18
2017-05-16
WordPress 2.5.0-4.7.4 - Post Meta Data Values Improper Handling in XML-RPC
Fixed in version 4.0.18
2017-05-16
WordPress 3.4.0-4.7.4 - XML-RPC Post Meta Data Lack of Capability Checks
Fixed in version 4.0.18
2017-05-16
WordPress 2.5.0-4.7.4 - Filesystem Credentials Dialog CSRF
Fixed in version 4.0.18
2017-05-16
WordPress 3.3-4.7.4 - Large File Upload Error XSS
Fixed in version 4.0.18
2017-05-16
WordPress 3.4.0-4.7.4 - Customizer XSS & CSRF
Fixed in version 4.0.18
2017-05-03
WordPress 2.3-4.8.3 - Host Header Injection in Password Reset
No known fix
2017-03-06
WordPress 3.6.0-4.7.2 - Authenticated Cross-Site Scripting (XSS) via Media File Metadata
Fixed in version 4.0.16
2017-03-06
WordPress 2.8.1-4.7.2 - Control Characters in Redirect URL Validation
Fixed in version 4.0.16
2017-03-06
WordPress 4.0-4.7.2 - Authenticated Stored Cross-Site Scripting (XSS) in YouTube URL Embeds
Fixed in version 4.0.16
2017-01-26
WordPress 3.5-4.7.1 - WP_Query SQL Injection
Fixed in version 4.0.15
2017-01-11
WordPress 2.9-4.7 - Authenticated Cross-Site scripting (XSS) in update-core.php
Fixed in version 4.0.14
2017-01-11
WordPress 3.4-4.7 - Stored Cross-Site Scripting (XSS) via Theme Name fallback
Fixed in version 4.0.14
2017-01-11
WordPress <= 4.7 - Post via Email Checks mail.example.com by Default
Fixed in version 4.0.14
2017-01-11
WordPress 2.8-4.7 - Accessibility Mode Cross-Site Request Forgery (CSRF)
Fixed in version 4.0.14
2017-01-11
WordPress 3.0-4.7 - Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Fixed in version 4.0.14
2016-09-07
WordPress 2.5-4.6 - Authenticated Stored Cross-Site Scripting via Image Filename
Fixed in version 4.0.13
2016-09-07
WordPress 2.8-4.6 - Path Traversal in Upgrade Package Uploader
Fixed in version 4.0.13
2016-06-21
WordPress 3.6-4.5.2 - Authenticated Revision History Information Disclosure
Fixed in version 4.0.12
2016-06-21
WordPress 2.6.0-4.5.2 - Unauthorized Category Removal from Post
Fixed in version 4.0.12
2016-05-06
WordPress <= 4.5.1 - Pupload Same Origin Method Execution (SOME)
Fixed in version 4.0.11
2016-04-12
WordPress <= 4.4.2 - SSRF Bypass using Octal & Hexedecimal IP addresses
Fixed in version 4.5
2016-04-12
WordPress <= 4.4.2 - Reflected XSS in Network Settings
Fixed in version 4.5
2016-04-12
WordPress <= 4.4.2 - Script Compression Option CSRF
Fixed in version 4.5
2016-02-02
WordPress 3.7-4.4.1 - Local URIs Server Side Request Forgery (SSRF)
Fixed in version 4.0.10
2016-02-02
WordPress 3.7-4.4.1 - Open Redirect
Fixed in version 4.0.10
2016-01-06
WordPress 3.7-4.4 - Authenticated Cross-Site Scripting (XSS)
Fixed in version 4.0.9
2015-09-15
WordPress <= 4.3 - Authenticated Shortcode Tags Cross-Site Scripting (XSS)
Fixed in version 4.0.8
2015-09-15
WordPress <= 4.3 - User List Table Cross-Site Scripting (XSS)
Fixed in version 4.0.8
2015-09-15
WordPress <= 4.3 - Publish Post & Mark as Sticky Permission Issue
Fixed in version 4.0.8
2015-08-05
WordPress <= 4.2.3 - Timing Side Channel Attack
Fixed in version 4.0.7
2015-08-05
WordPress <= 4.2.3 - Widgets Title Cross-Site Scripting (XSS)
Fixed in version 4.0.7
2015-08-05
WordPress <= 4.2.3 - Nav Menu Title Cross-Site Scripting (XSS)
Fixed in version 4.0.7
2015-08-05
WordPress <= 4.2.3 - Legacy Theme Preview Cross-Site Scripting (XSS)
Fixed in version 4.0.7
2015-08-04
WordPress <= 4.2.3 - wp_untrash_post_comments SQL Injection
Fixed in version 4.0.7
2015-07-23
WordPress <= 4.2.2 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in version 4.0.6
2015-04-21
WordPress <= 4.1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
Fixed in version 4.1.2
2015-04-21
WordPress 3.9-4.1.1 - Same-Origin Method Execution
Fixed in version 4.1.2
2014-11-30
WordPress 3.9, 3.9.1, 3.9.2, 4.0 - XSS in Media Playlists
Fixed in version 4.0.1
2014-11-30
WordPress <= 4.0 - Server Side Request Forgery (SSRF)
Fixed in version 4.0.1
2014-11-25
WordPress <= 4.0 - CSRF in wp-login.php Password Reset
Fixed in version 4.0.1
2014-11-20
WordPress <= 4.0 - Long Password Denial of Service (DoS)
Fixed in version 4.0.1