WordPress
by WordPress
Source repositories
CVEs (374)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-43497 | Med | 0.33 | 6.1 | 0.01 | Dec 5, 2022 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7. | ||
| CVE-2019-17672 | Med | 0.33 | 6.1 | 0.02 | Oct 17, 2019 | WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements. | ||
| CVE-2019-17671 | Med | 0.33 | 5.3 | 0.36 | Oct 17, 2019 | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled. | ||
| CVE-2019-16222 | Med | 0.33 | 6.1 | 0.02 | Sep 11, 2019 | WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks. | ||
| CVE-2019-16221 | Med | 0.33 | 6.1 | 0.02 | Sep 11, 2019 | WordPress before 5.2.3 allows reflected XSS in the dashboard. | ||
| CVE-2019-16220 | Med | 0.33 | 6.1 | 0.03 | Sep 11, 2019 | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash. | ||
| CVE-2019-16219 | Med | 0.33 | 6.1 | 0.02 | Sep 11, 2019 | WordPress before 5.2.3 allows XSS in shortcode previews. | ||
| CVE-2019-16218 | Med | 0.33 | 6.1 | 0.02 | Sep 11, 2019 | WordPress before 5.2.3 allows XSS in stored comments. | ||
| CVE-2019-16217 | Med | 0.33 | 6.1 | 0.02 | Sep 11, 2019 | WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. | ||
| CVE-2018-20150 | Med | 0.33 | 6.1 | 0.06 | Dec 14, 2018 | In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins. | ||
| CVE-2018-10102 | Med | 0.33 | 6.1 | 0.06 | Apr 16, 2018 | Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag. | ||
| CVE-2018-10101 | Med | 0.33 | 6.1 | 0.04 | Apr 16, 2018 | Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server. | ||
| CVE-2018-10100 | Med | 0.33 | 6.1 | 0.04 | Apr 16, 2018 | Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS. | ||
| CVE-2018-5776 | Med | 0.33 | 6.1 | 0.03 | Jan 18, 2018 | WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement). | ||
| CVE-2017-14726 | Med | 0.33 | 6.1 | 0.03 | Sep 23, 2017 | Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor. | ||
| CVE-2017-14724 | Med | 0.33 | 6.1 | 0.04 | Sep 23, 2017 | Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery. | ||
| CVE-2017-14721 | Med | 0.33 | 6.1 | 0.03 | Sep 23, 2017 | Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name. | ||
| CVE-2017-14720 | Med | 0.33 | 6.1 | 0.03 | Sep 23, 2017 | Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. | ||
| CVE-2017-14718 | Med | 0.33 | 6.1 | 0.03 | Sep 23, 2017 | Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. | ||
| CVE-2017-9063 | Med | 0.33 | 6.1 | 0.03 | May 18, 2017 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session. |
- risk 0.33cvss 6.1epss 0.01
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.
- risk 0.33cvss 6.1epss 0.02
WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.
- risk 0.33cvss 5.3epss 0.36
In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.
- risk 0.33cvss 6.1epss 0.02
WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks.
- risk 0.33cvss 6.1epss 0.02
WordPress before 5.2.3 allows reflected XSS in the dashboard.
- risk 0.33cvss 6.1epss 0.03
In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash.
- risk 0.33cvss 6.1epss 0.02
WordPress before 5.2.3 allows XSS in shortcode previews.
- risk 0.33cvss 6.1epss 0.02
WordPress before 5.2.3 allows XSS in stored comments.
- risk 0.33cvss 6.1epss 0.02
WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.
- risk 0.33cvss 6.1epss 0.06
In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.
- risk 0.33cvss 6.1epss 0.06
Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.
- risk 0.33cvss 6.1epss 0.04
Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.
- risk 0.33cvss 6.1epss 0.04
Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.
- risk 0.33cvss 6.1epss 0.03
WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).
- risk 0.33cvss 6.1epss 0.03
Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.
- risk 0.33cvss 6.1epss 0.04
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.
- risk 0.33cvss 6.1epss 0.03
Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.
- risk 0.33cvss 6.1epss 0.03
Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.
- risk 0.33cvss 6.1epss 0.03
Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.
- risk 0.33cvss 6.1epss 0.03
In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.
Page 6 of 19