Skip to content
Noroxi

WordPress records

666 published records for vendor WordPress. 5 of them have been exploited in the wild (listed in CISA KEV) and 16 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
5 · 0.8%
Weaponized
16 · 2.4%
Pre-auth RCE
102
With a fix record
53.3%
Median publish → KEV
4 days

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 16
  2. 17
  3. 18
  4. 19
  5. 20
  6. 21
  7. 22
  8. 23
  9. 24
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

666 records
  • CVE-2016-10033
    99Now

    The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail c

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    phpmailer project · phpmailerDec 30, 2016

  • CVE-2026-87902
    91Now

    An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the

    HighCVSS 8.1KEVWeaponizedEPSS 95%

    wordpress · wordpressSep 22, 2026

  • CVE-2026-63030
    72This week

    WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 10%

    wordpress · wordpressJul 17, 2026

  • CVE-2016-10045
    68This week

    The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently e

    CriticalCVSS 9.8WeaponizedEPSS 97%

    phpmailer project · phpmailerDec 30, 2016

  • CVE-2026-119977
    62This week

    WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

    HighCVSS 8.1KEVWeaponizedEPSS 1%

    wordpress · wordpressOct 31, 2026

  • CVE-2017-1001000
    60This week

    The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before

    HighCVSS 7.5WeaponizedEPSS 84%

    wordpress · wordpressApr 2, 2017

  • CVE-2019-8942
    60This week

    WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an a

    HighCVSS 8.8WeaponizedEPSS 82%

    wordpress · wordpressFeb 19, 2019

  • CVE-2016-6897
    60This week

    Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress bef

    MediumCVSS 6.5WeaponizedEPSS 28%

    wordpress · wordpressJan 18, 2017

  • CVE-2026-60137
    60This week

    WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

    MediumCVSS 5.9KEVWeaponizedEPSS 5%

    wordpress · wordpressJul 17, 2026

  • CVE-2022-21661
    59Plan

    SQL injection in WordPress

    HighCVSS 7.5Proof of conceptEPSS 97%

    wordpress · wordpressJan 6, 2022

  • CVE-2019-8943
    54Plan

    WordPress through 5.0.3 allows Path Traversal in wp_crop_image().

    MediumCVSS 6.5WeaponizedEPSS 91%

    wordpress · wordpressFeb 19, 2019

  • CVE-2018-12895
    54Plan

    WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb param

    HighCVSS 8.8WeaponizedEPSS 62%

    wordpress · wordpressJun 26, 2018

  • CVE-2021-29447
    52Plan

    WordPress Authenticated XXE attack when installation is running PHP 8

    MediumCVSS 6.5Proof of conceptEPSS 85%

    wordpress · wordpressApr 15, 2021

  • CVE-2018-6389
    52Plan

    In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of regist

    HighCVSS 7.5Proof of conceptEPSS 72%

    wordpress · wordpressFeb 6, 2018

  • CVE-2021-44223
    48Plan

    WordPress before 5.8 lacks support for the Update URI plugin header.

    CriticalCVSS 9.8No exploitEPSS 28%

    wordpress · wordpressNov 25, 2021

  • CVE-2017-5487
    47Plan

    wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not prop

    MediumCVSS 5.3Proof of conceptEPSS 87%

    wordpress · wordpressJan 14, 2017

  • CVE-2019-9787
    47Plan

    WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default conf

    HighCVSS 8.8Proof of conceptEPSS 38%

    wordpress · wordpressMar 14, 2019

  • CVE-2018-20148
    47Plan

    In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMedi

    CriticalCVSS 9.8Proof of conceptEPSS 26%

    wordpress · wordpressDec 14, 2018

  • CVE-2009-2335
    46Plan

    WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists,

    MediumCVSS 5.0WeaponizedEPSS 85%

    wordpress · wordpressJul 10, 2009

  • CVE-2014-9034
    45Plan

    wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers

    MediumCVSS 5.0Proof of conceptEPSS 83%

    wordpress · wordpressNov 25, 2014

  • CVE-2023-2745
    45Plan

    WordPress Core < 6.2.1 - Directory Traversal

    MediumCVSS 5.4Proof of conceptEPSS 79%

    wordpress · wordpressMay 17, 2023

  • CVE-2024-4439
    45Plan

    WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due t

    MediumCVSS 6.1Proof of conceptEPSS 71%

    wordpress · wordpressMay 3, 2024

  • CVE-2012-3576
    45Plan

    Unrestricted file upload vulnerability in php/upload.php in the wpStoreCart plugin before 2.5.30 for WordPress allows remote attackers to ex

    CriticalCVSS 10.0Proof of conceptEPSS 18%

    wordpress · wordpressJun 15, 2012

  • CVE-2008-3362
    45Plan

    Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attacke

    CriticalCVSS 10.0Proof of conceptEPSS 16%

    giulio ganci · wp downloads managerJul 30, 2008

  • CVE-2012-3575
    45Plan

    Unrestricted file upload vulnerability in uploader.php in the RBX Gallery plugin 2.1 for WordPress allows remote attackers to execute arbitr

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    rbx gallery · rbx galleryJun 15, 2012