WordPress Vulnerabilities

Version released on 2022-01-25

Download tar

Download zip

2022-12-13

WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding

No known fix

2022-10-17

WP < 6.0.3 - Reflected XSS via SQLi in Media Library

Fixed in version 5.9.5

2022-10-17

WP < 6.0.3 - Multiple Stored XSS via Gutenberg

Fixed in version 5.9.5

2022-10-17

WP < 6.0.3 - Data Exposure via REST Terms/Tags Endpoint

Fixed in version 5.9.5

2022-10-17

WP < 6.0.3 - Stored XSS via RSS Widget

Fixed in version 5.9.5

2022-10-17

WP < 6.0.3 - SQLi in WP_Date_Query

Fixed in version 5.9.5

2022-10-17

WP < 6.0.3 - Content from Multipart Emails Leaked

Fixed in version 5.9.5

2022-10-17

WP < 6.0.3 - Stored XSS via Comment Editing

Fixed in version 5.9.5

2022-10-17

WP < 6.0.3 - Stored XSS via the Customizer

Fixed in version 5.9.5

2022-10-17

WP < 6.0.3 - CSRF in wp-trackback.php

Fixed in version 5.9.5

2022-10-17

WP < 6.0.3 - Email Address Disclosure via wp-mail.php

Fixed in version 5.9.5

2022-10-17

WP < 6.0.3 - Open Redirect via wp_nonce_ays

Fixed in version 5.9.5

2022-10-17

WP < 6.0.3 - Stored XSS via wp-mail.php

Fixed in version 5.9.5

2022-08-30

WP < 6.0.2 - SQLi via Link API

Fixed in version 5.9.4

2022-08-30

WP < 6.0.2 - Authenticated Stored Cross-Site Scripting

Fixed in version 5.9.4

2022-08-30

WP < 6.0.2 - Reflected Cross-Site Scripting

Fixed in version 5.9.4

2022-03-11

WordPress (5.9-5.9.1) / Gutenberg (9.8.0-12.7.1) - Contributor+ Stored Cross-Site Scripting

Fixed in version 5.9.2

2022-03-11

WordPress < 5.9.2 / Gutenberg < 12.7.2 - Prototype Pollution via Gutenberg’s wordpress/url package

Fixed in version 5.9.2

2022-03-11

WordPress < 5.9.2 - Prototype Pollution in jQuery

Fixed in version 5.9.2