WordPress Vulnerabilities

Published
Title
Published
2026-09-22
Title
WP < 7.1.2 - Unauthenticated LFI via Page Template Resolution
Published
2026-09-17
Title
WP < 7.1.1 - Author+ Unauthorized Note Reparenting via REST API
Published
2026-09-17
Title
WP < 7.1.1 - Contributor+ Unpublished Post Title Disclosure
Published
2026-09-17
Title
WP < 7.1.1 - Author+ Unpublished Post Title Disclosure via Attachment Edit Screen
Published
2026-09-17
Title
WP < 7.1.1 - Contributor+ Arbitrary Post Modification
Published
2026-09-17
Title
WP < 7.1.1 - Admin+ CSS Injection on Multisite via XML-RPC
Published
2026-09-17
Title
WP < 7.1.1 - Author+ Path Traversal via Templates REST API
Published
2026-09-17
Title
WP < 7.1.1 - Admin+ Network-Wide Plugin Activation on Multisite
Published
2026-09-17
Title
WP < 7.1.1 - Theme Installation via CSRF
Published
2026-09-17
Title
WP < 7.1.1 - Admin+ Stored XSS via Custom Header
Published
2026-09-17
Title
WP < 7.1.1 - Unauthenticated Stored XSS via Comments
Published
2026-08-12
Title
WP < 7.0.4 - Author+ RCE via PDF Upload
Published
2026-08-06
Title
WP < 7.0.3 - Contributor+ Stored XSS via Gutenberg Post Content Block
Published
2026-08-06
Title
WP < 7.0.3 - Contributor+ Stored XSS via Gutenberg Post Date Block
Published
2026-08-06
Title
WP 7.0.x - Unauthenticated Password Protected Post Comment Disclosure via Gutenberg Latest Comments Block
Published
2026-08-06
Title
WP < 7.0.3 - Reflected XSS
Published
2026-08-06
Title
WP < 7.0.3 - Contributor+ Stored XSS via Emoji Settings Element
Published
2026-08-06
Title
WP < 7.0.3 - Subscriber+ Arbitrary Site Creation on Multisite
Published
2026-08-06
Title
WP < 7.0.3 - Contributor+ Stored XSS in Quick Edits
Published
2026-08-06
Title
WP < 7.0.3 - Unauthenticated Non-Public Post Type Slug Disclosure
Published
2026-08-06
Title
WP < 7.0.3 - Author+ CSS Injection
Published
2026-08-06
Title
WP < 7.0.3 - Unauthenticated Internal Note Disclosure via Comment Feeds
Published
2026-08-06
Title
WP < 7.0.3 - Unauthenticated Blind SSRF
Published
2026-08-06
Title
WP < 7.0.3 - Subscriber+ Email Change Confirmation Bypass
Published
2026-07-17
Title
WordPress < 7.0.2 - REST API batch-route confusion and SQLi to RCE