WordPress 6.3.2 Vulnerabilities

Version released on 2023-10-12

Download tar
Download zip
Published
Title
Fixed in
CVSS
Published
2026-09-22
Title
WP < 7.1.2 - Unauthenticated LFI via Page Template Resolution
Fixed in
Fixed in 6.3.12
CVSS
8.1 (high)
Published
2026-09-17
Title
WP < 7.1.1 - Unauthenticated Stored XSS via Comments
Fixed in
Fixed in 6.3.11
CVSS
8.8 (high)
Published
2026-09-17
Title
WP < 7.1.1 - Admin+ Stored XSS via Custom Header
Fixed in
Fixed in 6.3.11
CVSS
3.5 (low)
Published
2026-09-17
Title
WP < 7.1.1 - Theme Installation via CSRF
Fixed in
Fixed in 6.3.11
CVSS
4.3 (medium)
Published
2026-09-17
Title
WP < 7.1.1 - Admin+ Network-Wide Plugin Activation on Multisite
Fixed in
Fixed in 6.3.11
CVSS
2.2 (low)
Published
2026-09-17
Title
WP < 7.1.1 - Author+ Path Traversal via Templates REST API
Fixed in
Fixed in 6.3.11
CVSS
4.1 (medium)
Published
2026-09-17
Title
WP < 7.1.1 - Admin+ CSS Injection on Multisite via XML-RPC
Fixed in
Fixed in 6.3.11
CVSS
5.5 (medium)
Published
2026-09-17
Title
WP < 7.1.1 - Contributor+ Arbitrary Post Modification
Fixed in
Fixed in 6.3.11
CVSS
4.9 (medium)
Published
2026-09-17
Title
WP < 7.1.1 - Author+ Unpublished Post Title Disclosure via Attachment Edit Screen
Fixed in
Fixed in 6.3.11
CVSS
2.2 (low)
Published
2026-09-17
Title
WP < 7.1.1 - Contributor+ Unpublished Post Title Disclosure
Fixed in
Fixed in 6.3.11
CVSS
2.7 (low)
Published
2026-09-17
Title
WP < 7.1.1 - Author+ Unauthorized Note Reparenting via REST API
Fixed in
Fixed in 6.3.11
CVSS
2.7 (low)
Published
2026-08-12
Title
WP < 7.0.4 - Author+ RCE via PDF Upload
Fixed in
Fixed in 6.3.10
CVSS
6.6 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Subscriber+ Email Change Confirmation Bypass
Fixed in
Fixed in 6.3.9
CVSS
4.3 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Unauthenticated Blind SSRF
Fixed in
Fixed in 6.3.9
CVSS
5.8 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Author+ CSS Injection
Fixed in
Fixed in 6.3.9
CVSS
5.5 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Unauthenticated Non-Public Post Type Slug Disclosure
Fixed in
Fixed in 7.0.3
CVSS
5.3 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Contributor+ Stored XSS in Quick Edits
Fixed in
Fixed in 6.3.9
CVSS
6.8 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Subscriber+ Arbitrary Site Creation on Multisite
Fixed in
Fixed in 6.3.9
CVSS
4.3 (medium)
Published
2026-08-06
Title
WP < 7.0.3 - Reflected XSS
Fixed in
Fixed in 6.3.9
CVSS
7.1 (high)
Published
2025-09-22
Title
WP < 6.8.3 - Author+ DOM Stored XSS
Fixed in
Fixed in 6.3.7
CVSS
5.9 (medium)
Published
2025-09-22
Title
WP < 6.8.3 - Contributor+ Sensitive Data Disclosure
Fixed in
Fixed in 6.3.7
CVSS
2.7 (low)
Published
2024-06-24
Title
WordPress < 6.5.5 - Contributor+ Stored XSS in HTML API
Fixed in
Fixed in 6.3.5
CVSS
5.9 (medium)
Published
2024-06-24
Title
WordPress < 6.5.5 - Contributor+ Stored XSS in Template-Part Block
Fixed in
Fixed in 6.3.5
CVSS
5.9 (medium)
Published
2024-06-24
Title
WordPress < 6.5.5 - Contributor+ Path Traversal in Template-Part Block
Fixed in
Fixed in 6.3.5
CVSS
6.8 (medium)
Published
2024-04-09
Title
WP < 6.5.2 - Unauthenticated Stored XSS
Fixed in
Fixed in 6.3.4
CVSS
8.3 (high)
Published
2024-01-30
Title
WordPress < 6.4.3 - Deserialization of Untrusted Data
Fixed in
Fixed in 6.3.3
CVSS
8.5 (high)
Published
2024-01-30
Title
WordPress < 6.4.3 - Admin+ PHP File Upload
Fixed in
Fixed in 6.3.3
CVSS
6.6 (medium)