UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
804
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 4.9

    CVE-2017-6816 · WordPress

    In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.

    Published 12 Mar 2017 · NVD
  2. Medium 6.1

    CVE-2017-6815 · WordPress

    In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.

    Published 12 Mar 2017 · NVD
  3. Medium 5.4

    CVE-2017-6814 · WordPress

    In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) mishandling of the playlist shortcode in the wp_playlist_shortcode function in wp-includes/media.php and (2) mishandling of meta information in the renderTracks function in wp-includes/js/mediaelement/wp-playlist.js.

    Published 12 Mar 2017 · NVD
  4. Unrated

    WPV-997d4b495635 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 3 Feb 2017 · Fixed in 1.4.9 · WPVulnerability
  5. Unrated

    WPV-82f1e034774d · Gtranslate (WordPress plugin)

    Vulnerability in Translate WordPress with GTranslate

    Published 3 Feb 2017 · Fixed in 2.8.11 · WPVulnerability
  6. Medium 6.1

    CVE-2017-5612 · WordPress

    Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.

    Published 30 Jan 2017 · NVD
  7. Critical 9.8

    CVE-2017-5611 · WordPress

    SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name.

    Published 30 Jan 2017 · NVD
  8. Medium 5.3

    CVE-2017-5610 · WordPress

    wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict visibility of a taxonomy-assignment user interface, which allows remote attackers to bypass intended access restrictions by reading terms.

    Published 30 Jan 2017 · NVD
  9. Medium 6.5

    CVE-2016-6897 · WordPress

    Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 allows remote attackers to hijack the authentication of subscribers for /dev/random read operations by leveraging a late call to the check_ajax_referer function, a related issue to CVE-2016-6896.

    Published 18 Jan 2017 · NVD
  10. High 7.1

    CVE-2016-6896 · WordPress

    Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool.

    Published 18 Jan 2017 · NVD
  11. Medium 4.3

    CVE-2016-10148 · WordPress

    The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checking the update_plugins capability, which allows remote authenticated users to bypass intended read-access restrictions via the plugin parameter to wp-admin/admin-ajax.php, a related issue to CVE-2016-6896.

    Published 18 Jan 2017 · NVD
  12. High 7.5

    CVE-2017-5493 · WordPress

    wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted (1) site signup or (2) user signup.

    Published 15 Jan 2017 · NVD
  13. High 8.8

    CVE-2017-5492 · WordPress

    Cross-site request forgery (CSRF) vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php and wp-admin/widgets.php.

    Published 15 Jan 2017 · NVD
  14. Medium 5.3

    CVE-2017-5491 · WordPress

    wp-mail.php in WordPress before 4.7.1 might allow remote attackers to bypass intended posting restrictions via a spoofed mail server with the mail.example.com name.

    Published 15 Jan 2017 · NVD
  15. Medium 6.1

    CVE-2017-5490 · WordPress

    Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php.

    Published 15 Jan 2017 · NVD
  16. High 8.8

    CVE-2017-5489 · WordPress

    Cross-site request forgery (CSRF) vulnerability in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims via vectors involving a Flash file upload.

    Published 15 Jan 2017 · NVD
  17. Medium 6.1

    CVE-2017-5488 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) version header of a plugin.

    Published 15 Jan 2017 · NVD
  18. Medium 5.3

    CVE-2017-5487 · WordPress

    wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request.

    Published 15 Jan 2017 · NVD
  19. Medium 6.3

    CVE-2016-7169 · WordPress

    Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in WordPress before 4.6.1 allows remote authenticated users to access arbitrary files via a crafted urlholder parameter.

    Published 5 Jan 2017 · NVD
  20. Medium 4.8

    CVE-2016-7168 · WordPress

    Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attackers to inject arbitrary web script or HTML by tricking an administrator into uploading an image file that has a crafted filename.

    Published 5 Jan 2017 · NVD
  21. Critical 9.8

    CVE-2016-10045 · Joomla!, PHPMailer, WordPress

    The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.

    Published 30 Dec 2016 · Fixed in 5.2.20 · NVD
  22. Critical 9.8Actively exploited

    CVE-2016-10033 · Joomla!, PHPMailer, WordPress

    The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.

    Published 30 Dec 2016 · Fixed in 5.2.18 · NVD
  23. Unrated

    WPV-803a86c7f6a6 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 10 Nov 2016 · Fixed in 0.9.5 · WPVulnerability
  24. Unrated

    WPV-3a86881f34e4 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 31 Oct 2016 · Fixed in 0.9.5 · WPVulnerability
  25. Unrated

    WPV-d05a451389f7 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 27 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  26. Unrated

    WPV-c088b8f02483 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 27 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  27. Unrated

    WPV-bf344bf3a262 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 27 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  28. Unrated

    WPV-4cd16c8377a3 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 27 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  29. Unrated

    WPV-adb039f25864 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  30. Unrated

    WPV-8fde612f0730 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  31. Unrated

    WPV-4eb9434d7a35 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  32. Unrated

    WPV-4b1b785cdfa0 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  33. Unrated

    WPV-2ee9c58fe403 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 26 Sept 2016 · Fixed in 0.9.5 · WPVulnerability
  34. High 8.8

    CVE-2016-6635 · WordPress

    Cross-site request forgery (CSRF) vulnerability in the wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php in WordPress before 4.5 allows remote attackers to hijack the authentication of administrators for requests that change the script compression option.

    Published 7 Aug 2016 · NVD
  35. Medium 6.1

    CVE-2016-6634 · WordPress

    Cross-site scripting (XSS) vulnerability in the network settings page in WordPress before 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 7 Aug 2016 · NVD
  36. High 8.6

    CVE-2016-4029 · WordPress

    WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote attackers to bypass an intended SSRF protection mechanism via a crafted address.

    Published 7 Aug 2016 · Fixed in 4.5 · NVD
  37. Unrated

    WPV-4edde3b81b8f · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 3 Aug 2016 · Fixed in 3.4.1 · WPVulnerability
  38. Medium 5.4

    CVE-2021-24153 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 2 Aug 2016 · Fixed in 3.4.1 · NVD, WPVulnerability
  39. Unrated

    WPV-37b52e38ea4b · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 29 Jul 2016 · Fixed in 0.9.5 · WPVulnerability
  40. Unrated

    WPV-517508d538ba · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 28 Jul 2016 · Fixed in 1.4.5 · WPVulnerability
  41. Unrated

    WPV-3301354740c7 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 28 Jul 2016 · Fixed in 1.4.7 · WPVulnerability
  42. High 7.5

    CVE-2016-5839 · WordPress

    WordPress before 4.5.3 allows remote attackers to bypass the sanitize_file_name protection mechanism via unspecified vectors.

    Published 29 Jun 2016 · NVD
  43. High 7.5

    CVE-2016-5838 · WordPress

    WordPress before 4.5.3 allows remote attackers to bypass intended password-change restrictions by leveraging knowledge of a cookie.

    Published 29 Jun 2016 · NVD
  44. High 7.5

    CVE-2016-5837 · WordPress

    WordPress before 4.5.3 allows remote attackers to bypass intended access restrictions and remove a category attribute from a post via unspecified vectors.

    Published 29 Jun 2016 · NVD
  45. High 7.5

    CVE-2016-5836 · WordPress

    The oEmbed protocol implementation in WordPress before 4.5.3 allows remote attackers to cause a denial of service via unspecified vectors.

    Published 29 Jun 2016 · NVD
  46. High 7.5

    CVE-2016-5835 · WordPress

    WordPress before 4.5.3 allows remote attackers to obtain sensitive revision-history information by leveraging the ability to read a post, related to wp-admin/includes/ajax-actions.php and wp-admin/revision.php.

    Published 29 Jun 2016 · NVD
  47. Medium 6.1

    CVE-2016-5834 · WordPress

    Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.

    Published 29 Jun 2016 · NVD
  48. Medium 6.1

    CVE-2016-5833 · WordPress

    Cross-site scripting (XSS) vulnerability in the column_title function in wp-admin/includes/class-wp-media-list-table.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5834.

    Published 29 Jun 2016 · NVD
  49. High 7.5

    CVE-2016-5832 · WordPress

    The customizer in WordPress before 4.5.3 allows remote attackers to bypass intended redirection restrictions via unspecified vectors.

    Published 29 Jun 2016 · NVD
  50. Unrated

    WPV-fb264eab4f92 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 14 Jun 2016 · Fixed in 3.3.0 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.