WordPress Vulnerabilities

Version released on 2019-11-12

Download tar

Download zip

2022-03-11

WordPress < 5.9.2 - Prototype Pollution in jQuery

Fixed in version 5.3.12

2022-01-06

WordPress < 5.8.3 - Super Admin Object Injection in Multisites

Fixed in version 5.3.11

2022-01-06

WordPress 4.1-5.8.2 - SQL Injection via WP_Meta_Query

Fixed in version 5.3.11

2022-01-06

WordPress < 5.8.3 - Author+ Stored XSS via Post Slugs

Fixed in version 5.3.11

2022-01-06

WordPress < 5.8.3 - SQL Injection via WP_Query

Fixed in version 5.3.11

2021-11-25

WordPress < 5.8 - Plugin Confusion

Fixed in version 5.8

2021-11-10

WordPress < 5.8.2 - Expired DST Root CA X3 Certificate

Fixed in version 5.3.10

2021-05-13

WordPress 3.7 to 5.7.1 - Object Injection in PHPMailer

Fixed in version 5.3.8

2021-04-15

WordPress 4.7-5.7 - Authenticated Password Protected Pages Exposure

Fixed in version 5.3.7

2020-06-11

WordPress < 5.4.2 - Open Redirection

Fixed in version 5.3.4

2020-06-11

WordPress < 5.4.2 - Disclosure of Password-Protected Page/Post Comments

Fixed in version 5.3.4

2020-06-11

WordPress < 5.4.2 - Misuse of set-screen-option Leading to Privilege Escalation

Fixed in version 5.3.4

2020-06-11

WordPress < 5.4.2 - Authenticated Stored XSS via Theme Upload

Fixed in version 5.3.4

2020-06-11

WordPress < 5.4.2 - Authenticated XSS via Media Files

Fixed in version 5.3.4

2020-06-10

WordPress < 5.4.2 - Authenticated XSS in Block Editor

Fixed in version 5.3.4

2020-04-29

WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in File Uploads

Fixed in version 5.3.3

2020-04-29

WordPress < 5.4.1 - Cross-Site Scripting (XSS) in wp-object-cache

Fixed in version 5.3.3

2020-04-29

WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in Search Block

Fixed in version 5.3.3

2020-04-29

WordPress < 5.4.1 - Authenticated Cross-Site Scripting (XSS) in Customizer

Fixed in version 5.3.3

2020-04-29

WordPress < 5.4.1 - Unauthenticated Users View Private Posts

Fixed in version 5.3.3

2020-04-29

WordPress < 5.4.1 - Password Reset Tokens Failed to Be Properly Invalidated

Fixed in version 5.3.3

2019-12-13

WordPress <= 5.3 - Authenticated Improper Access Controls in REST API

Fixed in version 5.3.1

2019-12-13

WordPress <= 5.3 - wp_kses_bad_protocol() Colon Bypass

Fixed in version 5.3.1

2019-12-13

WordPress <= 5.3 - Authenticated Stored XSS via Block Editor Content

Fixed in version 5.3.1

2019-12-13

WordPress <= 5.3 - Authenticated Stored XSS via Crafted Links

Fixed in version 5.3.1