WordPress Vulnerabilities

Version released on 2020-09-01

Download tar

Download zip

2023-05-16

WP < 6.2.1 - Contributor+ Content Injection

Fixed in version 5.5.12

2023-05-16

WP < 6.2.2 - Shortcode Execution in User Generated Data

Fixed in version 5.5.12

2023-05-16

WP < 6.2.1 - Contributor+ Stored XSS via Open Embed Auto Discovery

Fixed in version 5.5.12

2023-05-16

WP < 6.2.1 - Thumbnail Image Update via CSRF

Fixed in version 5.5.12

2023-05-16

WP < 6.2.1 - Directory Traversal via Translation Files

Fixed in version 5.5.12

2022-12-13

WP <= 6.2 - Unauthenticated Blind SSRF via DNS Rebinding

No known fix

2022-10-17

WP < 6.0.3 - SQLi in WP_Date_Query

Fixed in version 5.5.11

2022-10-17

WP < 6.0.3 - Stored XSS via wp-mail.php

Fixed in version 5.5.11

2022-10-17

WP < 6.0.3 - Open Redirect via wp_nonce_ays

Fixed in version 5.5.11

2022-10-17

WP < 6.0.3 - Email Address Disclosure via wp-mail.php

Fixed in version 5.5.11

2022-10-17

WP < 6.0.3 - Reflected XSS via SQLi in Media Library

Fixed in version 5.5.11

2022-10-17

WP < 6.0.3 - CSRF in wp-trackback.php

Fixed in version 5.5.11

2022-10-17

WP < 6.0.3 - Stored XSS via the Customizer

Fixed in version 5.5.11

2022-10-17

WP < 6.0.3 - Stored XSS via Comment Editing

Fixed in version 5.5.11

2022-10-17

WP < 6.0.3 - Content from Multipart Emails Leaked

Fixed in version 5.5.11

2022-10-17

WP < 6.0.3 - Stored XSS via RSS Widget

Fixed in version 5.5.11

2022-10-17

WP < 6.0.3 - Data Exposure via REST Terms/Tags Endpoint

Fixed in version 5.5.11

2022-10-17

WP < 6.0.3 - Multiple Stored XSS via Gutenberg

Fixed in version 5.5.11

2022-08-30

WP < 6.0.2 - Reflected Cross-Site Scripting

Fixed in version 5.5.10

2022-08-30

WP < 6.0.2 - SQLi via Link API

Fixed in version 5.5.10

2022-08-30

WP < 6.0.2 - Authenticated Stored Cross-Site Scripting

Fixed in version 5.5.10

2022-03-11

WordPress < 5.9.2 - Prototype Pollution in jQuery

Fixed in version 5.5.9

2022-01-06

WordPress < 5.8.3 - Super Admin Object Injection in Multisites

Fixed in version 5.5.8

2022-01-06

WordPress 4.1-5.8.2 - SQL Injection via WP_Meta_Query

Fixed in version 5.5.8

2022-01-06

WordPress < 5.8.3 - Author+ Stored XSS via Post Slugs

Fixed in version 5.5.8

2022-01-06

WordPress < 5.8.3 - SQL Injection via WP_Query

Fixed in version 5.5.8

2021-11-25

WordPress < 5.8 - Plugin Confusion

Fixed in version 5.8

2021-11-10

WordPress < 5.8.2 - Expired DST Root CA X3 Certificate

Fixed in version 5.5.7

2021-09-09

WordPress 5.4 to 5.8 - Lodash Library Update

Fixed in version 5.5.6

2021-09-09

WordPress 5.4 to 5.8 - Authenticated XSS in Block Editor

Fixed in version 5.5.6

2021-09-09

WordPress 5.4 to 5.8 - Data Exposure via REST API

Fixed in version 5.5.6

2021-05-13

WordPress 3.7 to 5.7.1 - Object Injection in PHPMailer

Fixed in version 5.5.5

2021-04-15

WordPress 4.7-5.7 - Authenticated Password Protected Pages Exposure

Fixed in version 5.5.4

2020-10-29

WordPress < 5.5.2 - Hardening Deserialization Requests

Fixed in version 5.5.2

2020-10-29

WordPress < 5.5.2 - Cross-Site Request Forgery (CSRF) to Change Theme Background

Fixed in version 5.5.2

2020-10-29

WordPress < 5.5.2 - Protected Meta That Could Lead to Arbitrary File Deletion

Fixed in version 5.5.2

2020-10-29

WordPress < 5.5.2 - Stored XSS in Post Slugs

Fixed in version 5.5.2

2020-10-29

WordPress < 5.5.2 - Unauthenticated DoS Attack to RCE

Fixed in version 5.5.2

2020-10-29

WordPress < 5.5.2 - XML-RPC Privilege Escalation

Fixed in version 5.5.2

2020-10-29

WordPress < 5.5.2 - Cross-Site Scripting (XSS) via Global Variables

Fixed in version 5.5.2

2020-10-29

WordPress < 5.5.2 - Disable Spam Embeds from Disabled Sites on a Multisite Network

Fixed in version 5.5.2