UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
810
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Unrated

    WPV-01e34f670867 · WP Mail Smtp (WordPress plugin)

    Vulnerability in WP Mail SMTP by WPForms – Free SMTP Plugin with Gmail, Outlook, Amazon SES, SendGrid, Mailgun, Zoho & other SMTP

    Published 19 Sept 2018 · Fixed in 1.4.0 · WPVulnerability
  2. Unrated

    WPV-f204757c4c2b · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 18 Sept 2018 · Fixed in 1.4.8 · WPVulnerability
  3. High 8.8

    CVE-2018-1000773 · WordPress

    WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time.

    Published 6 Sept 2018 · NVD
  4. High 8.8

    CVE-2017-1000600 · WordPress

    WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially, but not completely…

    Published 6 Sept 2018 · Fixed in 4.9 · NVD
  5. High 7.2

    CVE-2018-14028 · WordPress

    In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then execute the file. This represents a security risk in limited scenarios where an attacker (who does…

    Published 10 Aug 2018 · NVD
  6. High 8.8

    CVE-2018-12895 · WordPress

    WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are…

    Published 26 Jun 2018 · Fixed in 4.9.7 · NVD
  7. High 7.2

    CVE-2018-1000504 · Redirection (WordPress plugin)

    Redirection: Open Redirect

    Published 26 Jun 2018 · Fixed in 2.8 · WPVulnerability
  8. Unrated

    WPV-367f190b7403 · Redirection (WordPress plugin)

    Vulnerability in Redirection

    Published 20 Jun 2018 · Fixed in 2.8 · WPVulnerability
  9. Medium 5.4

    CVE-2018-0578 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Cross-site Scripting

    Published 27 Apr 2018 · Fixed in 5.3.0 · WPVulnerability
  10. Medium 6.1

    CVE-2018-10102 · WordPress

    Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.

    Published 16 Apr 2018 · Fixed in 4.9.5 · NVD
  11. Medium 6.1

    CVE-2018-10101 · WordPress

    Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as the WordPress server.

    Published 16 Apr 2018 · Fixed in 4.9.5 · NVD
  12. Medium 6.1

    CVE-2018-10100 · WordPress

    Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use HTTPS.

    Published 16 Apr 2018 · Fixed in 4.9.5 · NVD
  13. High 8.1

    CVE-2014-6412 · WordPress

    WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.

    Published 12 Apr 2018 · Fixed in 4.4.0 · NVD
  14. High 7.5

    CVE-2018-6389 · WordPress

    In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.

    Published 6 Feb 2018 · NVD
  15. Medium 6.1

    CVE-2018-5776 · WordPress

    WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).

    Published 18 Jan 2018 · Fixed in 4.9.2 · NVD
  16. Unrated

    WPV-f6e223f56671 · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Published 17 Jan 2018 · Fixed in 2.2.0 · WPVulnerability
  17. Unrated

    WPV-bf65ffde71b0 · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Published 16 Jan 2018 · Fixed in 2.2.0 · WPVulnerability
  18. Medium 5.4

    CVE-2017-17094 · WordPress

    wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, which might allow attackers to conduct XSS attacks via a crafted URL.

    Published 2 Dec 2017 · Fixed in 4.9.1 · NVD
  19. Medium 5.4

    CVE-2017-17093 · WordPress

    wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element, which might allow attackers to conduct XSS attacks via the language setting of a site.

    Published 2 Dec 2017 · Fixed in 4.9.1 · NVD
  20. Medium 5.4

    CVE-2017-17092 · WordPress

    wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files, which might allow remote attackers to conduct XSS attacks via a crafted file.

    Published 2 Dec 2017 · Fixed in 4.9.1 · NVD
  21. High 8.8

    CVE-2017-17091 · WordPress

    wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access restrictions by entering this string.

    Published 2 Dec 2017 · NVD
  22. Unrated

    WPV-d2188ae68dcd · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 20 Nov 2017 · Fixed in 5.8.0 · WPVulnerability
  23. Medium 4.8

    CVE-2017-16842 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 16 Nov 2017 · Fixed in 5.8.0 · WPVulnerability
  24. Critical 9.8

    CVE-2017-16510 · WordPress

    WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "double prepare" approach, a different vulnerability than CVE-2017-14723.

    Published 2 Nov 2017 · NVD
  25. High 7.5

    CVE-2012-6707 · WordPress

    WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2.…

    Published 19 Oct 2017 · NVD
  26. Medium 4.7

    CVE-2016-9263 · WordPress

    WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Flash injection (XSF) attacks by leveraging code contained within the wp-includes/js/mediaelement/flashmediaelement.swf file.

    Published 12 Oct 2017 · NVD
  27. Medium 6.5

    CVE-2017-14990 · WordPress

    WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key values as hashes), which might make it easier for remote attackers to hijack unactivated user accounts by leveraging database read access (such as access gained through an unspecified SQL injection vulnerability).

    Published 3 Oct 2017 · NVD
  28. Medium 6.1

    CVE-2017-14726 · WordPress

    Before version 4.8.2, WordPress was vulnerable to a cross-site scripting attack via shortcodes in the TinyMCE visual editor.

    Published 23 Sept 2017 · NVD
  29. Medium 5.4

    CVE-2017-14725 · WordPress

    Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php.

    Published 23 Sept 2017 · NVD
  30. Medium 6.1

    CVE-2017-14724 · WordPress

    Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery.

    Published 23 Sept 2017 · NVD
  31. Critical 9.8

    CVE-2017-14723 · WordPress

    Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks.

    Published 23 Sept 2017 · NVD
  32. High 7.5

    CVE-2017-14722 · WordPress

    Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename.

    Published 23 Sept 2017 · NVD
  33. Medium 6.1

    CVE-2017-14721 · WordPress

    Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin editor via a crafted plugin name.

    Published 23 Sept 2017 · NVD
  34. Medium 6.1

    CVE-2017-14720 · WordPress

    Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name.

    Published 23 Sept 2017 · NVD
  35. High 7.5

    CVE-2017-14719 · WordPress

    Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.

    Published 23 Sept 2017 · NVD
  36. Medium 6.1

    CVE-2017-14718 · WordPress

    Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL.

    Published 23 Sept 2017 · NVD
  37. Unrated

    WPV-3ad5db4857fe · WP Rocket (WordPress plugin)

    Vulnerability in WP Rocket

    Published 28 Jul 2017 · Fixed in 2.10.4 · WPVulnerability
  38. High 7.5

    CVE-2017-11658 · WP Rocket (WordPress plugin)

    WP Rocket: Path Traversal

    Published 22 Jun 2017 · Fixed in 2.10.4 · WPVulnerability
  39. High 8.6

    CVE-2017-9066 · WordPress

    In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF.

    Published 18 May 2017 · NVD
  40. High 7.5

    CVE-2017-9065 · WordPress

    In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API.

    Published 18 May 2017 · NVD
  41. High 8.8

    CVE-2017-9064 · WordPress

    In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials.

    Published 18 May 2017 · NVD
  42. Medium 6.1

    CVE-2017-9063 · WordPress

    In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session.

    Published 18 May 2017 · NVD
  43. High 8.6

    CVE-2017-9062 · WordPress

    In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API.

    Published 18 May 2017 · NVD
  44. Medium 6.1

    CVE-2017-9061 · WordPress

    In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename.

    Published 18 May 2017 · NVD
  45. Unrated

    WPV-02c6e05dce9d · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 11 May 2017 · Fixed in 3.3.2 · WPVulnerability
  46. Medium 5.9

    CVE-2017-8295 · WordPress

    WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to transmission of the reset key to a mailbox on an attacker-controlled SMTP server. This is related to…

    Published 4 May 2017 · NVD
  47. High 7.5

    CVE-2017-1001000 · WordPress

    The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json/wp/v2/posts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json/wp/v2/posts/123?id=123helloworld…

    Published 3 Apr 2017 · NVD
  48. Medium 6.5

    CVE-2017-6819 · WordPress

    In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to excessive use of server resources. The CSRF can trigger an outbound HTTP request for a large file that is then parsed by Press This.

    Published 12 Mar 2017 · NVD
  49. Medium 6.1

    CVE-2017-6818 · WordPress

    In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names.

    Published 12 Mar 2017 · NVD
  50. Medium 5.4

    CVE-2017-6817 · WordPress

    In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.

    Published 12 Mar 2017 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.