WordPress 5.5.1 Vulnerabilities

Version released on 2020-09-01

Download tar
Download zip
Published
Title
Fixed in
CVSS
Published
2024-01-30
Title
WordPress < 6.4.3 - Deserialization of Untrusted Data
Fixed in
Fixed in 5.5.14
CVSS
8.5 (high)
Published
2024-01-30
Title
WordPress < 6.4.3 - Admin+ PHP File Upload
Fixed in
Fixed in 5.5.14
CVSS
6.6 (medium)
Published
2023-10-12
Title
WP < 6.3.2 - Denial of Service via Cache Poisoning
Fixed in
Fixed in 5.5.13
CVSS
5.3 (medium)
Published
2023-10-12
Title
WP < 6.3.2 - Subscriber+ Arbitrary Shortcode Execution
Fixed in
Fixed in 5.5.13
CVSS
4.3 (medium)
Published
2023-10-12
Title
WP < 6.3.2 - Contributor+ Comment Disclosure
Fixed in
Fixed in 5.5.13
CVSS
2.7 (low)
Published
2023-10-12
Title
WP < 6.3.2 - Unauthenticated Post Author Email Disclosure
Fixed in
Fixed in 5.5.13
CVSS
5.3 (medium)
Published
2023-05-16
Title
WP < 6.2.1 - Directory Traversal via Translation Files
Fixed in
Fixed in 5.5.12
CVSS
4.8 (medium)
Published
2023-05-16
Title
WP < 6.2.1 - Thumbnail Image Update via CSRF
Fixed in
Fixed in 5.5.12
CVSS
4.3 (medium)
Published
2023-05-16
Title
WP < 6.2.1 - Contributor+ Stored XSS via Open Embed Auto Discovery
Fixed in
Fixed in 5.5.12
CVSS
6.8 (medium)
Published
2023-05-16
Title
WP < 6.2.2 - Shortcode Execution in User Generated Data
Fixed in
Fixed in 5.5.12
CVSS
6.5 (medium)
Published
2023-05-16
Title
WP < 6.2.1 - Contributor+ Content Injection
Fixed in
Fixed in 5.5.12
CVSS
5.5 (medium)
Published
2022-12-13
Title
WP <= 6.2 - Unauthenticated Blind SSRF via DNS Rebinding
Fixed in
No known fix
CVSS
5.4 (medium)
Published
2022-10-17
Title
WP < 6.0.3 - Stored XSS via wp-mail.php
Fixed in
Fixed in 5.5.11
CVSS
4.8 (medium)
Published
2022-10-17
Title
WP < 6.0.3 - Open Redirect via wp_nonce_ays
Fixed in
Fixed in 5.5.11
CVSS
4.3 (medium)
Published
2022-10-17
Title
WP < 6.0.3 - Email Address Disclosure via wp-mail.php
Fixed in
Fixed in 5.5.11
CVSS
3.1 (low)
Published
2022-10-17
Title
WP < 6.0.3 - Reflected XSS via SQLi in Media Library
Fixed in
Fixed in 5.5.11
CVSS
4.7 (medium)
Published
2022-10-17
Title
WP < 6.0.3 - CSRF in wp-trackback.php
Fixed in
Fixed in 5.5.11
CVSS
3.1 (low)
Published
2022-10-17
Title
WP < 6.0.3 - Stored XSS via the Customizer
Fixed in
Fixed in 5.5.11
CVSS
3.4 (low)
Published
2022-10-17
Title
WP < 6.0.3 - Stored XSS via Comment Editing
Fixed in
Fixed in 5.5.11
CVSS
4.4 (medium)
Published
2022-10-17
Title
WP < 6.0.3 - Content from Multipart Emails Leaked
Fixed in
Fixed in 5.5.11
CVSS
3.7 (low)
Published
2022-10-17
Title
WP < 6.0.3 - SQLi in WP_Date_Query
Fixed in
Fixed in 5.5.11
CVSS
4.0 (medium)
Published
2022-10-17
Title
WP < 6.0.3 - Stored XSS via RSS Widget
Fixed in
Fixed in 5.5.11
CVSS
3.0 (low)
Published
2022-10-17
Title
WP < 6.0.3 - Data Exposure via REST Terms/Tags Endpoint
Fixed in
Fixed in 5.5.11
CVSS
4.3 (medium)
Published
2022-10-17
Title
WP < 6.0.3 - Multiple Stored XSS via Gutenberg
Fixed in
Fixed in 5.5.11
CVSS
3.4 (low)
Published
2022-08-30
Title
WP < 6.0.2 - Reflected Cross-Site Scripting
Fixed in
Fixed in 5.5.10
CVSS
4.7 (medium)
Published
2022-08-30
Title
WP < 6.0.2 - Authenticated Stored Cross-Site Scripting
Fixed in
Fixed in 5.5.10
CVSS
2.6 (low)
Published
2022-08-30
Title
WP < 6.0.2 - SQLi via Link API
Fixed in
Fixed in 5.5.10
CVSS
5.8 (medium)
Published
2022-03-11
Title
WordPress < 5.9.2 - Prototype Pollution in jQuery
Fixed in
Fixed in 5.5.9
CVSS
5.6 (medium)
Published
2022-01-06
Title
WordPress < 5.8.3 - SQL Injection via WP_Query
Fixed in
Fixed in 5.5.8
CVSS
8.6 (high)
Published
2022-01-06
Title
WordPress < 5.8.3 - Author+ Stored XSS via Post Slugs
Fixed in
Fixed in 5.5.8
CVSS
5.4 (medium)
Published
2022-01-06
Title
WordPress 4.1-5.8.2 - SQL Injection via WP_Meta_Query
Fixed in
Fixed in 5.5.8
CVSS
6.8 (medium)
Published
2022-01-06
Title
WordPress < 5.8.3 - Super Admin Object Injection in Multisites
Fixed in
Fixed in 5.5.8
CVSS
3.3 (low)
Published
2021-11-25
Title
WordPress < 5.8 - Plugin Confusion
Fixed in
Fixed in 5.8
CVSS
8.2 (high)
Published
2021-11-10
Title
WordPress < 5.8.2 - Expired DST Root CA X3 Certificate
Fixed in
Fixed in 5.5.7
CVSS
n/a
Published
2021-09-09
Title
WordPress 5.4 to 5.8 - Lodash Library Update
Fixed in
Fixed in 5.5.6
CVSS
6.3 (medium)
Published
2021-09-09
Title
WordPress 5.4 to 5.8 - Authenticated XSS in Block Editor
Fixed in
Fixed in 5.5.6
CVSS
5.4 (medium)
Published
2021-09-09
Title
WordPress 5.4 to 5.8 - Data Exposure via REST API
Fixed in
Fixed in 5.5.6
CVSS
5.3 (medium)
Published
2021-05-13
Title
WordPress 3.7 to 5.7.1 - Object Injection in PHPMailer
Fixed in
Fixed in 5.5.5
CVSS
6.6 (medium)
Published
2021-04-15
Title
WordPress 4.7-5.7 - Authenticated Password Protected Pages Exposure
Fixed in
Fixed in 5.5.4
CVSS
4.3 (medium)
Published
2020-10-29
Title
WordPress < 5.5.2 - Hardening Deserialization Requests
Fixed in
Fixed in 5.5.2
CVSS
0.0 (none)
Published
2020-10-29
Title
WordPress < 5.5.2 - Disable Spam Embeds from Disabled Sites on a Multisite Network
Fixed in
Fixed in 5.5.2
CVSS
0.0 (none)
Published
2020-10-29
Title
WordPress < 5.5.2 - Cross-Site Scripting (XSS) via Global Variables
Fixed in
Fixed in 5.5.2
CVSS
3.5 (low)
Published
2020-10-29
Title
WordPress < 5.5.2 - XML-RPC Privilege Escalation
Fixed in
Fixed in 5.5.2
CVSS
5.4 (medium)
Published
2020-10-29
Title
WordPress < 5.5.2 - Unauthenticated DoS Attack to RCE
Fixed in
Fixed in 5.5.2
CVSS
8.1 (high)
Published
2020-10-29
Title
WordPress < 5.5.2 - Stored XSS in Post Slugs
Fixed in
Fixed in 5.5.2
CVSS
3.5 (low)
Published
2020-10-29
Title
WordPress < 5.5.2 - Protected Meta That Could Lead to Arbitrary File Deletion
Fixed in
Fixed in 5.5.2
CVSS
4.3 (medium)
Published
2020-10-29
Title
WordPress < 5.5.2 - Cross-Site Request Forgery (CSRF) to Change Theme Background
Fixed in
Fixed in 5.5.2
CVSS
5.4 (medium)