Total 391 security vulnerabilities recorded for wordpress software and firmware.
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__no...
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which co...
WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the ...
The Thanh Toรกn Quรฉt Mรฃ QR Code Tแปฑ ฤแปng โ MoMo, ViettelPay, VNPay vร 40 ngรขn hร ng Viแปt Nam plugin for WordPress is vulnerable to Stored Cross-Site Scri...
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insuffic...
WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__d...
WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an a...
WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addres...
Exposure of Sensitive Information to an Unauthorized Actor in WordPressย from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6....
Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress coreย 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1...
A vulnerability was found in Blogger Importer Plugin up to 0.5 on WordPress. It has been classified as problematic. Affected is the function start/res...
Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <=ย 2.2.0 versions....
Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <=ย 1.5.1 versions....
WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the โwp_langโ parameter. This allows unauthenticated at...
A vulnerability was found in dd32 Debug Bar Plugin up to 0.8 on WordPress. It has been declared as problematic. Affected by this vulnerability is the ...
WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code ...
WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and t...
Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the...
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The de...
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The de...
A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow ...
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in...
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admi...
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (l...