Aggregates CVE and security vulnerability intelligence across all WordPress-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk sql injection, vendor risk csrf, vendor risk input validation, and vendor risk open redirect and related problems; some flaws may lead to vendor impact data exposure.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2019-17674 | WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer. | [email protected] | 5.4 | 1.61% | 2019-10-17 | 2026-06-16 |
| CVE-2019-17673 | WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header. | [email protected] | 7.5 | 3.15% | 2019-10-17 | 2026-06-16 |
| CVE-2019-17672 | WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements. | [email protected] | 6.1 | 1.77% | 2019-10-17 | 2026-06-16 |
| CVE-2019-17671 | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled. | [email protected] | 5.3 | 36.50% | 2019-10-17 | 2026-06-16 |
| CVE-2019-17670 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs. | [email protected] | 9.8 | 4.51% | 2019-10-17 | 2026-06-16 |
| CVE-2019-17669 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters. | [email protected] | 9.8 | 5.24% | 2019-10-17 | 2026-06-16 |
| CVE-2019-16223 | WordPress before 5.2.3 allows XSS in post previews by authenticated users. | [email protected] | 5.4 | 5.18% | 2019-09-11 | 2026-06-16 |
| CVE-2019-16222 | WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks. | [email protected] | 6.1 | 2.20% | 2019-09-11 | 2026-06-16 |
| CVE-2019-16221 | WordPress before 5.2.3 allows reflected XSS in the dashboard. | [email protected] | 6.1 | 1.77% | 2019-09-11 | 2026-06-16 |
| CVE-2019-16220 | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash. | [email protected] | 6.1 | 2.55% | 2019-09-11 | 2026-06-16 |
| CVE-2019-16219 | WordPress before 5.2.3 allows XSS in shortcode previews. | [email protected] | 6.1 | 1.89% | 2019-09-11 | 2026-06-16 |
| CVE-2019-16218 | WordPress before 5.2.3 allows XSS in stored comments. | [email protected] | 6.1 | 1.81% | 2019-09-11 | 2026-06-16 |
| CVE-2019-16217 | WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled. | [email protected] | 6.1 | 1.53% | 2019-09-11 | 2026-06-16 |
| CVE-2017-6514 | WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring. | [email protected] | 5.3 | 3.01% | 2019-05-22 | 2026-06-16 |
| CVE-2019-9787 | WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php. | [email protected] | 8.8 | 43.75% | 2019-03-14 | 2026-06-16 |
| CVE-2019-8943 | WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring. | [email protected] | 6.5 | 91.98% | 2019-02-19 | 2026-06-16 |
| CVE-2019-8942 | WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943. | [email protected] | 8.8 | 82.74% | 2019-02-19 | 2026-06-16 |
| CVE-2018-20153 | In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS. | [email protected] | 5.4 | 2.47% | 2018-12-14 | 2026-06-16 |
| CVE-2018-20152 | In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input. | [email protected] | 6.5 | 4.21% | 2018-12-14 | 2026-06-16 |
| CVE-2018-20151 | In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default. | [email protected] | 7.5 | 6.68% | 2018-12-14 | 2026-06-16 |