Total 391 security vulnerabilities recorded for wordpress software and firmware.
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Qu...
WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-...
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions authent...
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the wid...
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. ### Impact The issue allows ...
WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions output ...
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests`...
Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. ...
Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leadin...
WordPress before 5.5.2 allows CSRF attacks that change a theme's background image....
is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a me...
WordPress before 5.5.2 allows stored XSS via post slugs....
is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might all...
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post....
WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC....
WordPress before 5.5.2 allows XSS associated with global variables....
WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed....
WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php....
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the...
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does requ...
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution...
In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading t...
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attac...
In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfilt...