UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
800
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 4.3

    CVE-2013-0236 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery shortcodes or (2) the content of a post.

    Published 8 Jul 2013 · NVD
  2. Medium 6.4

    CVE-2013-0235 · WordPress

    The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.

    Published 8 Jul 2013 · NVD
  3. Medium 4.3

    CVE-2013-2173 · WordPress

    wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to cause a denial of service (CPU consumption) via a crafted value of a certain wp-postpass cookie.

    Published 21 Jun 2013 · NVD
  4. Unrated

    WPV-b7d84268101e · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 1 May 2013 · Fixed in 0.9.2.9 · WPVulnerability
  5. Unrated

    WPV-461ca88e6b36 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 24 Apr 2013 · Fixed in 1.3 · WPVulnerability
  6. Low 2.6

    CVE-2012-5868 · WordPress

    WordPress 3.4.2 does not invalidate a wordpress_sec session cookie upon an administrator's logout action, which makes it easier for remote attackers to discover valid session identifiers via a brute-force attack, or modify data via a replay attack.

    Published 27 Dec 2012 · NVD
  7. High 7.5

    CVE-2012-5469 · phpMyAdmin

    The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain phpMyAdmin console access via a direct request to wp-content/plugins/portable-phpmyadmin/wp-pma-mod.

    Published 20 Dec 2012 · NVD
  8. Unrated

    CVE-2012-6692 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 31 Oct 2012 · Fixed in 2.2 · WPVulnerability
  9. Unrated

    WPV-ea90e885ae84 · Akismet (WordPress plugin)

    Vulnerability in Akismet Anti-spam: Spam Protection

    Published 1 Oct 2012 · Fixed in 1.1 · WPVulnerability
  10. Medium 6.8

    CVE-2012-4448 · WordPress

    Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard_incoming_links edit action.

    Published 28 Sept 2012 · NVD
  11. Low 3.5

    CVE-2012-4422 · WordPress

    wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role.

    Published 14 Sept 2012 · NVD
  12. Medium 4.0

    CVE-2012-4421 · WordPress

    The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass intended access restrictions and publish new posts by leveraging the Contributor role and using the Atom Publishing Protocol (aka AtomPub) feature.

    Published 14 Sept 2012 · NVD
  13. Medium 6.5

    CVE-2010-5106 · WordPress

    The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended access restrictions, and publish, edit, or delete posts, by leveraging the Author or Contributor role.

    Published 14 Sept 2012 · NVD
  14. Medium 5.0

    CVE-2012-3385 · WordPress

    WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors.

    Published 22 Jul 2012 · NVD
  15. Medium 6.8

    CVE-2012-3384 · WordPress

    Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

    Published 22 Jul 2012 · NVD
  16. Low 2.6

    CVE-2012-3383 · WordPress

    The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks by leveraging the Administrator or Editor role and composing crafted text.

    Published 22 Jul 2012 · NVD
  17. Medium 5.0

    CVE-2011-4957 · WordPress

    The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service (crash) via a comment with a crafted URL that triggers many recursive calls.

    Published 27 Jun 2012 · NVD
  18. Medium 4.3

    CVE-2011-4956 · WordPress

    Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    Published 27 Jun 2012 · NVD
  19. Medium 6.1

    CVE-2012-6717 · Redirection (WordPress plugin)

    Redirection: Cross-site Scripting

    Published 4 May 2012 · Fixed in 2.2.12 · WPVulnerability
  20. Medium 6.8

    CVE-2012-1936 · WordPress

    The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks on specific actions and objects by sniffing the network, as demonstrated by attacks against the wp-admin/admin-ajax.php and…

    Published 3 May 2012 · NVD
  21. Medium 4.3

    CVE-2012-2404 · WordPress

    wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

    Published 21 Apr 2012 · NVD
  22. Medium 4.3

    CVE-2012-2403 · WordPress

    wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

    Published 21 Apr 2012 · NVD
  23. Medium 5.5

    CVE-2012-2402 · WordPress

    wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.

    Published 21 Apr 2012 · NVD
  24. Medium 5.0

    CVE-2012-2401 · WordPress

    Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.

    Published 21 Apr 2012 · NVD
  25. High 10.0

    CVE-2012-2400 · WordPress

    Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors.

    Published 21 Apr 2012 · NVD
  26. High 10.0

    CVE-2012-2399 · WordPress

    Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.

    Published 21 Apr 2012 · NVD
  27. Medium 5.0

    CVE-2012-0937 · WordPress

    wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898. NOTE: the vendor disputes the significance…

    Published 30 Jan 2012 · NVD
  28. Medium 4.3

    CVE-2012-0782 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance

    Published 30 Jan 2012 · NVD
  29. High 7.5

    CVE-2011-4899 · WordPress

    wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query.…

    Published 30 Jan 2012 · NVD
  30. Medium 5.0

    CVE-2011-4898 · WordPress

    wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a series of requests with different uname and pwd parameters. NOTE: the vendor disputes the significance…

    Published 30 Jan 2012 · NVD
  31. Low 2.6

    CVE-2012-0287 · WordPress

    Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected" feature.

    Published 6 Jan 2012 · NVD
  32. Unrated

    CVE-2011-4562 · Redirection (WordPress plugin)

    Redirection: Cross-site Scripting

    Published 28 Nov 2011 · Fixed in 2.2.10 · WPVulnerability
  33. Medium 5.0

    CVE-2011-3818 · WordPress

    WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.php and certain other files.

    Published 24 Sept 2011 · NVD
  34. High 7.5

    CVE-2011-3130 · WordPress

    wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibly involving SQL injection.

    Published 10 Aug 2011 · NVD
  35. High 9.3

    CVE-2011-3129 · WordPress

    The file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running "on hosts with dangerous security settings," has unknown impact and attack vectors, possibly related to dangerous filenames.

    Published 10 Aug 2011 · NVD
  36. Medium 5.0

    CVE-2011-3128 · WordPress

    WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php.

    Published 10 Aug 2011 · NVD
  37. Medium 5.8

    CVE-2011-3127 · WordPress

    WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

    Published 10 Aug 2011 · NVD
  38. Medium 5.0

    CVE-2011-3126 · WordPress

    WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects.

    Published 10 Aug 2011 · NVD
  39. High 10.0

    CVE-2011-3125 · WordPress

    Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various security hardening."

    Published 10 Aug 2011 · NVD
  40. High 10.0

    CVE-2011-3122 · WordPress

    Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media security."

    Published 10 Aug 2011 · NVD
  41. Medium 4.0

    CVE-2011-0701 · WordPress

    wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.

    Published 14 Mar 2011 · NVD
  42. Low 3.5

    CVE-2011-0700 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, and (5) escaping of tags within the tags meta box.

    Published 14 Mar 2011 · NVD
  43. Medium 4.3

    CVE-2010-4536 · WordPress

    Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form.

    Published 3 Jan 2011 · NVD
  44. Medium 6.0

    CVE-2010-4257 · WordPress

    SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field.

    Published 7 Dec 2010 · NVD
  45. Medium 4.0

    CVE-2010-0682 · WordPress

    WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.

    Published 23 Feb 2010 · NVD
  46. Low 3.5

    CVE-2009-3891 · WordPress

    Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter (aka the selection variable).

    Published 17 Nov 2009 · NVD
  47. Medium 6.0

    CVE-2009-3890 · WordPress

    Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to…

    Published 17 Nov 2009 · NVD
  48. Medium 4.3

    CVE-2009-3622 · WordPress

    Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU consumption and server hang) via a long title parameter in conjunction with a charset parameter composed of many comma-separated "UTF-8" substrings, related to the mb_convert_encoding function in PHP.

    Published 23 Oct 2009 · NVD
  49. Medium 6.4

    CVE-2009-2854 · WordPress

    Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthorized edits or additions via a direct request to (1) edit-comments.php, (2) edit-pages.php, (3) edit.php, (4) edit-category-form.php, (5) edit-link-category-form.php, (6) edit-tag-form.php, (7) export.php, (8) import.php, or (9) link-add.php in wp-admin/.

    Published 18 Aug 2009 · NVD
  50. High 10.0

    CVE-2009-2853 · WordPress

    Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edit-category-form.php, (3) edit-form-advanced.php, (4) edit-form-comment.php, (5) edit-link-category-form.php, (6) edit-link-form.php, (7) edit-page-form.php, and (8) edit-tag-form.php in wp-admin/.

    Published 18 Aug 2009 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.