WordPress Vulnerabilities

Version released on 2017-08-02

Download tar

Download zip

2023-05-16

WP < 6.2.1 - Directory Traversal via Translation Files

Fixed in version 4.8.22

2023-05-16

WP < 6.2.1 - Thumbnail Image Update via CSRF

Fixed in version 4.8.22

2023-05-16

WP < 6.2.2 - Shortcode Execution in User Generated Data

Fixed in version 4.8.22

2023-05-16

WP < 6.2.1 - Contributor+ Stored XSS via Open Embed Auto Discovery

Fixed in version 4.8.22

2023-05-16

WP < 6.2.1 - Contributor+ Content Injection

Fixed in version 4.8.22

2022-12-13

WP <= 6.2 - Unauthenticated Blind SSRF via DNS Rebinding

No known fix

2022-10-17

WP < 6.0.3 - Stored XSS via wp-mail.php

Fixed in version 4.8.21

2022-10-17

WP < 6.0.3 - Open Redirect via wp_nonce_ays

Fixed in version 4.8.21

2022-10-17

WP < 6.0.3 - Email Address Disclosure via wp-mail.php

Fixed in version 4.8.21

2022-10-17

WP < 6.0.3 - Reflected XSS via SQLi in Media Library

Fixed in version 4.8.21

2022-10-17

WP < 6.0.3 - CSRF in wp-trackback.php

Fixed in version 4.8.21

2022-10-17

WP < 6.0.3 - Stored XSS via the Customizer

Fixed in version 4.8.21

2022-10-17

WP < 6.0.3 - Stored XSS via Comment Editing

Fixed in version 4.8.21

2022-10-17

WP < 6.0.3 - Content from Multipart Emails Leaked

Fixed in version 4.8.21

2022-10-17

WP < 6.0.3 - SQLi in WP_Date_Query

Fixed in version 4.8.21

2022-10-17

WP < 6.0.3 - Stored XSS via RSS Widget

Fixed in version 4.8.21

2022-10-17

WP < 6.0.3 - Data Exposure via REST Terms/Tags Endpoint

Fixed in version 4.8.21

2022-10-17

WP < 6.0.3 - Multiple Stored XSS via Gutenberg

Fixed in version 4.8.21

2022-08-30

WP < 6.0.2 - Reflected Cross-Site Scripting

Fixed in version 4.8.20

2022-08-30

WP < 6.0.2 - Authenticated Stored Cross-Site Scripting

Fixed in version 4.8.20

2022-08-30

WP < 6.0.2 - SQLi via Link API

Fixed in version 4.8.20

2022-03-11

WordPress < 5.9.2 - Prototype Pollution in jQuery

Fixed in version 4.8.19

2022-01-06

WordPress < 5.8.3 - SQL Injection via WP_Query

Fixed in version 4.8.18

2022-01-06

WordPress < 5.8.3 - Author+ Stored XSS via Post Slugs

Fixed in version 4.8.18

2022-01-06

WordPress 4.1-5.8.2 - SQL Injection via WP_Meta_Query

Fixed in version 4.8.18

2022-01-06

WordPress < 5.8.3 - Super Admin Object Injection in Multisites

Fixed in version 4.8.18

2021-11-25

WordPress < 5.8 - Plugin Confusion

Fixed in version 5.8

2021-05-13

WordPress 3.7 to 5.7.1 - Object Injection in PHPMailer

Fixed in version 4.8.17

2021-04-15

WordPress 4.7-5.7 - Authenticated Password Protected Pages Exposure

Fixed in version 4.8.16

2020-06-11

WordPress < 5.4.2 - Authenticated XSS via Media Files

Fixed in version 4.8.14

2020-06-11

WordPress < 5.4.2 - Open Redirection

Fixed in version 4.8.14

2020-06-11

WordPress < 5.4.2 - Authenticated Stored XSS via Theme Upload

Fixed in version 4.8.14

2020-06-11

WordPress < 5.4.2 - Misuse of set-screen-option Leading to Privilege Escalation

Fixed in version 4.8.14

2020-06-11

WordPress < 5.4.2 - Disclosure of Password-Protected Page/Post Comments

Fixed in version 4.8.14

2020-04-29

WordPress < 5.4.1 - Password Reset Tokens Failed to Be Properly Invalidated

Fixed in version 4.8.13

2020-04-29

WordPress < 5.4.1 - Unauthenticated Users View Private Posts

Fixed in version 4.8.13

2020-04-29

WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in Customizer

Fixed in version 4.8.13

2020-04-29

WordPress < 5.4.1 - Cross-Site Scripting (XSS) in wp-object-cache

Fixed in version 4.8.13

2020-04-29

WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in File Uploads

Fixed in version 4.8.13

2020-01-21

WordPress <= 5.2.3 - Hardening Bypass

Fixed in version 4.8.11

2019-12-13

WordPress <= 5.3 - Authenticated Improper Access Controls in REST API

Fixed in version 4.8.12

2019-12-13

WordPress <= 5.3 - Authenticated Stored XSS via Crafted Links

Fixed in version 4.8.12

2019-12-13

WordPress <= 5.3 - Authenticated Stored XSS via Block Editor Content

Fixed in version 4.8.12

2019-12-13

WordPress <= 5.3 - wp_kses_bad_protocol() Colon Bypass

Fixed in version 4.8.12

2019-10-14

WordPress <= 5.2.3 - Stored XSS in Customizer

Fixed in version 4.8.11

2019-10-14

WordPress <= 5.2.3 - Unauthenticated View Private/Draft Posts

Fixed in version 4.8.11

2019-10-14

WordPress <= 5.2.3 - Stored XSS in Style Tags

Fixed in version 4.8.11

2019-10-14

WordPress <= 5.2.3 - JSON Request Cache Poisoning

Fixed in version 4.8.11

2019-10-14

WordPress <= 5.2.3 - Server-Side Request Forgery (SSRF) in URL Validation

Fixed in version 4.8.11

2019-10-14

WordPress <= 5.2.3 - Admin Referrer Validation

Fixed in version 4.8.11

2019-09-05

WordPress <= 5.2.2 - Cross-Site Scripting (XSS) in URL Sanitisation

Fixed in version 4.8.10

2019-03-13

WordPress 3.9-5.1 - Comment Cross-Site Scripting (XSS)

Fixed in version 4.8.9

2019-02-19

WordPress 3.7-5.0 (except 4.9.9) - Authenticated Code Execution

Fixed in version 5.0.1

2018-12-13

WordPress <= 5.0 - Authenticated File Delete

Fixed in version 4.8.8

2018-12-13

WordPress <= 5.0 - Authenticated Post Type Bypass

Fixed in version 4.8.8

2018-12-13

WordPress <= 5.0 - PHP Object Injection via Meta Data

Fixed in version 4.8.8

2018-12-13

WordPress <= 5.0 - Authenticated Cross-Site Scripting (XSS)

Fixed in version 4.8.8

2018-12-13

WordPress <= 5.0 - Cross-Site Scripting (XSS) that could affect plugins

Fixed in version 4.8.8

2018-12-13

WordPress <= 5.0 - User Activation Screen Search Engine Indexing

Fixed in version 4.8.8

2018-12-13

WordPress <= 5.0 - File Upload to XSS on Apache Web Servers

Fixed in version 4.8.8

2018-06-27

WordPress <= 4.9.6 - Authenticated Arbitrary File Deletion

Fixed in version 4.8.7

2018-04-03

WordPress 3.7-4.9.4 - Remove localhost Default

Fixed in version 4.8.6

2018-04-03

WordPress 3.7-4.9.4 - Use Safe Redirect for Login

Fixed in version 4.8.6

2018-04-03

WordPress 3.7-4.9.4 - Escape Version in Generator Tag

Fixed in version 4.8.6

2018-02-05

WordPress <= 4.9.4 - Application Denial of Service (DoS) (unpatched)

No known fix

2018-01-17

WordPress 3.7-4.9.1 - MediaElement Cross-Site Scripting (XSS)

Fixed in version 4.8.5

2017-11-29

WordPress 2.8.6-4.9 - Authenticated JavaScript File Upload

Fixed in version 4.8.4

2017-11-29

WordPress 1.5.0-4.9 - RSS and Atom Feed Escaping

Fixed in version 4.8.4

2017-11-29

WordPress 4.3.0-4.9 - HTML Language Attribute Escaping

Fixed in version 4.8.4

2017-11-29

WordPress 3.7-4.9 - 'newbloguser' Key Weak Hashing

Fixed in version 4.8.4

2017-10-31

WordPress <= 4.8.2 - $wpdb->prepare() Weakness

Fixed in version 4.8.3

2017-09-20

WordPress 2.9.2-4.8.1 - Open Redirect

Fixed in version 4.8.2

2017-09-20

WordPress 3.0-4.8.1 - Path Traversal in Unzipping

Fixed in version 4.8.2

2017-09-19

WordPress 2.3.0-4.8.1 - $wpdb->prepare() potential SQL Injection

Fixed in version 4.8.2

2017-09-19

WordPress 4.4-4.8.1 - Path Traversal in Customizer

Fixed in version 4.8.2

2017-09-19

WordPress 4.4-4.8.1 - Cross-Site Scripting (XSS) in oEmbed

Fixed in version 4.8.2

2017-09-19

WordPress 4.2.3-4.8.1 - Authenticated Cross-Site Scripting (XSS) in Visual Editor

Fixed in version 4.8.2

2017-05-03

WordPress 2.3-4.8.3 - Host Header Injection in Password Reset

No known fix