UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
804
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Unrated

    WPV-7f2619adec9d · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 14 Jun 2016 · Fixed in 3.3.0 · WPVulnerability
  2. Medium 6.1

    CVE-2016-4567 · WordPress

    Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."

    Published 22 May 2016 · NVD
  3. Medium 6.1

    CVE-2016-4566 · WordPress

    Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via a Same-Origin Method Execution (SOME) attack.

    Published 22 May 2016 · NVD
  4. High 8.6

    CVE-2016-2222 · WordPress

    The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct server-side request forgery (SSRF) attacks via a zero value in the first octet of an IPv4 address in the u parameter to wp-admin/press-this.php.

    Published 22 May 2016 · NVD
  5. High 7.4

    CVE-2016-2221 · WordPress

    Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a malformed URL that triggers incorrect hostname parsing, as demonstrated by an https:example.com URL.

    Published 22 May 2016 · NVD
  6. Medium 6.1

    CVE-2016-1564 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a (1) stylesheet name or (2) template name to wp-admin/customize.php.

    Published 22 May 2016 · NVD
  7. Medium 6.1

    CVE-2015-8834 · WordPress

    Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440.

    Published 22 May 2016 · NVD
  8. Medium 5.4

    CVE-2015-7989 · WordPress

    Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted e-mail address, a different vulnerability than CVE-2015-5714.

    Published 22 May 2016 · NVD
  9. Medium 4.3

    CVE-2015-5715 · WordPress

    The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.

    Published 22 May 2016 · NVD
  10. Medium 6.1

    CVE-2015-5714 · WordPress

    Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML elements during processing of shortcode tags.

    Published 22 May 2016 · NVD
  11. Unrated

    WPV-e1eafa9535b1 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 6 May 2016 · Fixed in 3.2.5 · WPVulnerability
  12. Unrated

    WPV-ad93c471e5c7 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 6 May 2016 · Fixed in 3.2.5 · WPVulnerability
  13. Medium 4.3

    CVE-2015-5734 · WordPress

    Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string.

    Published 9 Nov 2015 · NVD
  14. Medium 4.3

    CVE-2015-5733 · WordPress

    Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title.

    Published 9 Nov 2015 · NVD
  15. Medium 4.3

    CVE-2015-5732 · WordPress

    Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a widget title.

    Published 9 Nov 2015 · NVD
  16. Medium 6.8

    CVE-2015-5731 · WordPress

    Cross-site request forgery (CSRF) vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests that lock a post, and consequently cause a denial of service (editing blockage), via a get-post-lock action.

    Published 9 Nov 2015 · NVD
  17. Medium 5.0

    CVE-2015-5730 · WordPress

    The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.

    Published 9 Nov 2015 · NVD
  18. High 7.5

    CVE-2015-2213 · WordPress

    SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash.

    Published 9 Nov 2015 · NVD
  19. Unrated

    WPV-7c991982251b · Akismet (WordPress plugin)

    Vulnerability in Akismet Anti-spam: Spam Protection

    Published 13 Oct 2015 · Fixed in 3.1.5 · WPVulnerability
  20. Medium 6.1

    CVE-2015-9357 · Akismet (WordPress plugin)

    Akismet Anti-spam: Spam Protection: Cross-site Scripting

    Published 13 Oct 2015 · Fixed in 3.1.5 · WPVulnerability
  21. Unrated

    WPV-b28039f3e2cf · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 26 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  22. Unrated

    WPV-22a8df67b13a · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 26 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  23. Unrated

    WPV-822eb8c8780d · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 25 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  24. Unrated

    WPV-64658a4f2f13 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 25 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  25. Unrated

    WPV-191aaebdae4e · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 25 Sept 2015 · Fixed in 1.4.5 · WPVulnerability
  26. Medium 4.3

    CVE-2015-3439 · WordPress

    Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as.

    Published 5 Aug 2015 · NVD
  27. Medium 4.3

    CVE-2015-3438 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTML via a (1) four-byte UTF-8 character or (2) invalid character that reaches the database layer, as demonstrated by a crafted character in a comment.

    Published 5 Aug 2015 · NVD
  28. Medium 4.0

    CVE-2015-5623 · WordPress

    WordPress before 4.2.3 does not properly verify the edit_posts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php.

    Published 3 Aug 2015 · NVD
  29. Low 3.5

    CVE-2015-5622 · WordPress

    Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor role to place a crafted shortcode inside an HTML element, related to wp-includes/kses.php and wp-includes/shortcodes.php.

    Published 3 Aug 2015 · NVD
  30. Medium 4.3

    CVE-2015-3440 · WordPress

    Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.

    Published 3 Aug 2015 · NVD
  31. Medium 5.0

    CVE-2014-9734 · Slider Revolution

    Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.

    Published 30 Jun 2015 · NVD
  32. Unrated

    WPV-fed8e858bf29 · Redirection (WordPress plugin)

    Vulnerability in Redirection

    Published 15 May 2015 · Fixed in 2.3.4 · WPVulnerability
  33. Unrated

    WPV-fc8e1afbc29b · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 15 May 2015 · Fixed in 0.9.4.1 · WPVulnerability
  34. Unrated

    WPV-e4f87b5e23e2 · Redirection (WordPress plugin)

    Vulnerability in Redirection

    Published 15 May 2015 · Fixed in 2.2.9 · WPVulnerability
  35. Unrated

    WPV-aa479f9eee49 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 15 May 2015 · Fixed in 1.3.1 · WPVulnerability
  36. Unrated

    WPV-0f62f5811d51 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 15 May 2015 · Fixed in 1.4.3 · WPVulnerability
  37. Unrated

    WPV-608914b2227f · Twentyfifteen (WordPress theme)

    Vulnerability in Twenty Fifteen

    Published 6 May 2015 · WPVulnerability
  38. Unrated

    WPV-e79447e47a65 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 20 Apr 2015 · Fixed in 2.1 · WPVulnerability
  39. Unrated

    WPV-2f093ee917a5 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 20 Apr 2015 · Fixed in 2.1 · WPVulnerability
  40. Unrated

    CVE-2015-3429 · Twentyfifteen (WordPress theme)

    Twenty Fifteen: Cross-site Scripting

    Published 8 Apr 2015 · Fixed in 1.2 · WPVulnerability
  41. Unrated

    WPV-61aeaef9deb3 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 7 Apr 2015 · Fixed in 1.4.3 · WPVulnerability
  42. Unrated

    CVE-2015-2292 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: SQL Injection

    Published 11 Mar 2015 · Fixed in 1.7.4 · WPVulnerability
  43. Unrated

    CVE-2015-2293 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-Site Request Forgery (CSRF)

    Published 10 Mar 2015 · Fixed in 1.7.4 · WPVulnerability
  44. Medium 4.3

    CVE-2014-9039 · WordPress

    wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message.

    Published 25 Nov 2014 · NVD
  45. Medium 6.4

    CVE-2014-9038 · WordPress

    wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource.

    Published 25 Nov 2014 · NVD
  46. Medium 6.8

    CVE-2014-9037 · WordPress

    WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash.

    Published 25 Nov 2014 · NVD
  47. Medium 4.3

    CVE-2014-9036 · WordPress

    Cross-site scripting (XSS) vulnerability in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted Cascading Style Sheets (CSS) token sequence in a post.

    Published 25 Nov 2014 · NVD
  48. Medium 4.3

    CVE-2014-9035 · WordPress

    Cross-site scripting (XSS) vulnerability in Press This in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 25 Nov 2014 · NVD
  49. Medium 5.0

    CVE-2014-9034 · WordPress

    wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.

    Published 25 Nov 2014 · NVD
  50. Medium 6.8

    CVE-2014-9033 · WordPress

    Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords.

    Published 25 Nov 2014 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.