WordPress: known security problems

427 known security problems reported for this WordPress, with the affected versions, the fix and what to do.

Updated 30 October 2026

In short

There are 427 known security problems on this page. 426 of them have a fixed version. Updating to version 7.1.4 or newer covers every fixed problem listed here.

Based on public reports. Check the WordPress’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

Today

A stranger could read or delete private files on your server

Attackers are using it right now. If your site has an affected version, fix it today.

Affected versions

From 4.7 up to and including 4.7.36
From 4.8 up to and including 4.8.31
From 4.9 up to and including 4.9.32
From 5.0 up to and including 5.0.28
From 5.1 up to and including 5.1.25
From 5.2 up to and including 5.2.27
From 5.3 up to and including 5.3.24
From 5.4 up to and including 5.4.22
From 5.5 up to and including 5.5.21
From 5.6 up to and including 5.6.20
From 5.7 up to and including 5.7.18
From 5.8 up to and including 5.8.16
From 5.9 up to and including 5.9.17
From 6.0 up to and including 6.0.15
From 6.1 up to and including 6.1.13
From 6.2 up to and including 6.2.12
From 6.3 up to and including 6.3.11
From 6.4 up to and including 6.4.11
From 6.5 up to and including 6.5.11
From 6.6 up to and including 6.6.8
From 6.7 up to and including 6.7.8
From 6.8 up to and including 6.8.9
From 6.9 up to and including 6.9.8
From 7.0 up to and including 7.0.5
From 7.1 up to and including 7.1.1

Fixed in

4.7.37, 4.8.32, 4.9.33, 5.0.29, 5.1.26, 5.2.28, 5.3.25, 5.4.23, 5.5.22, 5.6.21, 5.7.19, 5.8.17, 5.9.18, 6.0.16, 6.1.14, 6.2.13, 6.3.12, 6.4.12, 6.5.12, 6.6.9, 6.7.9, 6.8.10, 6.9.9, 7.0.6, 7.1.2

What to do

If your site has an affected version, update WordPress to version 7.1.2 or newer.

Official ID

CVE-2026-87902

Report title

WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal

First reported

22 September 2026

Sources

Wordfence, seen 22 September 2026
CISA

Today

Someone could run their own code on your site and take it over (from 6.9 up to, but not including, 6.9.5; from 7.0 up to, but not including, 7.0.2)

Attackers are using it right now. If your site has an affected version, fix it today.

Affected versions

From 6.9 up to, but not including, 6.9.5
From 7.0 up to, but not including, 7.0.2

Fixed in

6.9.5, 7.0.2

What to do

If your site has an affected version, update WordPress to version 7.0.2 or newer.

Official ID

CVE-2026-63030

Report title

WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion

First reported

17 July 2026

Sources

Wordfence, seen 17 July 2026
CISA

Today

A stranger could read or change the data in your site’s database

Attackers are using it right now. If your site has an affected version, fix it today.

Affected versions

From 6.8 up to, but not including, 6.8.5
From 6.9 up to, but not including, 6.9.5
From 7.0 up to, but not including, 7.0.2

Fixed in

6.8.6, 6.9.5, 7.0.2

What to do

If your site has an affected version, update WordPress to version 7.0.2 or newer.

Official ID

CVE-2026-60137

Report title

WordPress Core 6.8 - 7.0.1 - Unauthenticated SQL Injection via author__not_in Parameter

First reported

17 July 2026

Sources

Wordfence, seen 17 July 2026
CISA

This week

Someone could plant harmful code that runs for your visitors or admins (from 4.7.0 up to and including 4.7.38; from 4.8.0 up to and including 4.8.33; from 4.9.0 up to and including 4.9.34; from 5.0.0 up to and including 5.0.30; from 5.1.0 up to and including 5.1.27; from 5.2.0 up to and including 5.2.29; from 5.3.0 up to and including 5.3.26; from 5.4.0 up to and including 5.4.24; from 5.5.0 up to and including 5.5.23; from 5.6.0 up to and including 5.6.22; from 5.7.0 up to and including 5.7.20; from 5.8.0 up to and including 5.8.18; from 5.9.0 up to and including 5.9.19; from 6.0.0 up to and including 6.0.17; from 6.1.0 up to and including 6.1.15; from 6.2.0 up to and including 6.2.14; from 6.3.0 up to and including 6.3.13; from 6.4.0 up to and including 6.4.13; from 6.5.0 up to and including 6.5.13; from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.38
From 4.8.0 up to and including 4.8.33
From 4.9.0 up to and including 4.9.34
From 5.0.0 up to and including 5.0.30
From 5.1.0 up to and including 5.1.27
From 5.2.0 up to and including 5.2.29
From 5.3.0 up to and including 5.3.26
From 5.4.0 up to and including 5.4.24
From 5.5.0 up to and including 5.5.23
From 5.6.0 up to and including 5.6.22
From 5.7.0 up to and including 5.7.20
From 5.8.0 up to and including 5.8.18
From 5.9.0 up to and including 5.9.19
From 6.0.0 up to and including 6.0.17
From 6.1.0 up to and including 6.1.15
From 6.2.0 up to and including 6.2.14
From 6.3.0 up to and including 6.3.13
From 6.4.0 up to and including 6.4.13
From 6.5.0 up to and including 6.5.13
From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

4.7.39, 4.8.34, 4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 4.7.0 - 7.1.3 - Authenticated (Custom+) Stored Cross-Site Scripting via Externally-Supplied User Login Values

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 5.0.0 up to and including 5.0.30; from 5.1.0 up to and including 5.1.27; from 5.2.0 up to and including 5.2.29; from 5.3.0 up to and including 5.3.26; from 5.4.0 up to and including 5.4.24; from 5.5.0 up to and including 5.5.23; from 5.6.0 up to and including 5.6.22; from 5.7.0 up to and including 5.7.20; from 5.8.0 up to and including 5.8.18; from 5.9.0 up to and including 5.9.19; from 6.0.0 up to and including 6.0.17; from 6.1.0 up to and including 6.1.15; from 6.2.0 up to and including 6.2.14; from 6.3.0 up to and including 6.3.13; from 6.4.0 up to and including 6.4.13; from 6.5.0 up to and including 6.5.13; from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.0.0 up to and including 5.0.30
From 5.1.0 up to and including 5.1.27
From 5.2.0 up to and including 5.2.29
From 5.3.0 up to and including 5.3.26
From 5.4.0 up to and including 5.4.24
From 5.5.0 up to and including 5.5.23
From 5.6.0 up to and including 5.6.22
From 5.7.0 up to and including 5.7.20
From 5.8.0 up to and including 5.8.18
From 5.9.0 up to and including 5.9.19
From 6.0.0 up to and including 6.0.17
From 6.1.0 up to and including 6.1.15
From 6.2.0 up to and including 6.2.14
From 6.3.0 up to and including 6.3.13
From 6.4.0 up to and including 6.4.13
From 6.5.0 up to and including 6.5.13
From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 5.0.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Customizer Selective Refresh

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins (from 6.4.0 up to and including 6.4.14; from 6.5.0 up to and including 6.5.14; from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.4.0 up to and including 6.4.14
From 6.5.0 up to and including 6.5.14
From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 6.4.0 - 7.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via Interactivity Router Uploaded Text Files

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 5.0.0 up to and including 5.0.30; from 5.1.0 up to and including 5.1.27; from 5.2.0 up to and including 5.2.29; from 5.3.0 up to and including 5.3.26; from 5.4.0 up to and including 5.4.24; from 5.5.0 up to and including 5.5.23; from 5.6.0 up to and including 5.6.22; from 5.7.0 up to and including 5.7.20; from 5.8.0 up to and including 5.8.18; from 5.9.0 up to and including 5.9.19; from 6.0.0 up to and including 6.0.17; from 6.1.0 up to and including 6.1.15; from 6.2.0 up to and including 6.2.14; from 6.3.0 up to and including 6.3.13; from 6.4.0 up to and including 6.4.13; from 6.5.0 up to and including 6.5.13; from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.0.0 up to and including 5.0.30
From 5.1.0 up to and including 5.1.27
From 5.2.0 up to and including 5.2.29
From 5.3.0 up to and including 5.3.26
From 5.4.0 up to and including 5.4.24
From 5.5.0 up to and including 5.5.23
From 5.6.0 up to and including 5.6.22
From 5.7.0 up to and including 5.7.20
From 5.8.0 up to and including 5.8.18
From 5.9.0 up to and including 5.9.19
From 6.0.0 up to and including 6.0.17
From 6.1.0 up to and including 6.1.15
From 6.2.0 up to and including 6.2.14
From 6.3.0 up to and including 6.3.13
From 6.4.0 up to and including 6.4.13
From 6.5.0 up to and including 6.5.13
From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 5.0.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Non-HTML Whitespace in Block Delimiters

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

A stranger could see private information they should not see (from 4.9.0 up to and including 4.9.34; from 5.0.0 up to and including 5.0.30; from 5.1.0 up to and including 5.1.27; from 5.2.0 up to and including 5.2.29; from 5.3.0 up to and including 5.3.26; from 5.4.0 up to and including 5.4.24; from 5.5.0 up to and including 5.5.23; from 5.6.0 up to and including 5.6.22; from 5.7.0 up to and including 5.7.20; from 5.8.0 up to and including 5.8.18; from 5.9.0 up to and including 5.9.19; from 6.0.0 up to and including 6.0.17; from 6.1.0 up to and including 6.1.15; from 6.2.0 up to and including 6.2.14; from 6.3.0 up to and including 6.3.13; from 6.4.0 up to and including 6.4.13; from 6.5.0 up to and including 6.5.13; from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.9.0 up to and including 4.9.34
From 5.0.0 up to and including 5.0.30
From 5.1.0 up to and including 5.1.27
From 5.2.0 up to and including 5.2.29
From 5.3.0 up to and including 5.3.26
From 5.4.0 up to and including 5.4.24
From 5.5.0 up to and including 5.5.23
From 5.6.0 up to and including 5.6.22
From 5.7.0 up to and including 5.7.20
From 5.8.0 up to and including 5.8.18
From 5.9.0 up to and including 5.9.19
From 6.0.0 up to and including 6.0.17
From 6.1.0 up to and including 6.1.15
From 6.2.0 up to and including 6.2.14
From 6.3.0 up to and including 6.3.13
From 6.4.0 up to and including 6.4.13
From 6.5.0 up to and including 6.5.13
From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 4.9.0 - 7.1.3 - Unauthenticated Sensitive Information Exposure via Customizer Changesets

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 6.4.0 up to and including 6.4.13; from 6.5.0 up to and including 6.5.13; from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.4.0 up to and including 6.4.13
From 6.5.0 up to and including 6.5.13
From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 6.4.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API Prototype Pollution

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API Event Handler Bindings

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity API URL Bindings

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 5.9.0 up to and including 5.9.19; from 6.0.0 up to and including 6.0.17; from 6.1.0 up to and including 6.1.15; from 6.2.0 up to and including 6.2.14; from 6.3.0 up to and including 6.3.13; from 6.4.0 up to and including 6.4.13; from 6.5.0 up to and including 6.5.13; from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.9.0 up to and including 5.9.19
From 6.0.0 up to and including 6.0.17
From 6.1.0 up to and including 6.1.15
From 6.2.0 up to and including 6.2.14
From 6.3.0 up to and including 6.3.13
From 6.4.0 up to and including 6.4.13
From 6.5.0 up to and including 6.5.13
From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 5.9.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Block Labels

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone with a contributor account on your site could slow down or crash your site (from 6.4.0 up to and including 6.4.13; from 6.5.0 up to and including 6.5.13; from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.4.0 up to and including 6.4.13
From 6.5.0 up to and including 6.5.13
From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 6.4.0 - 7.1.3 - Authenticated (Contributor+) Stored Denial of Service via Malformed Interactivity API Bindings

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Interactivity Script Module Data Shadowing

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 6.4.0 up to and including 6.4.13; from 6.5.0 up to and including 6.5.13; from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.4.0 up to and including 6.4.13
From 6.5.0 up to and including 6.5.13
From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 6.4.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image and Playlist Blocks

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone with an editor account on your site could plant harmful code that runs for your visitors or admins (from 4.9.6 up to and including 4.9.34; from 5.0.0 up to and including 5.0.30; from 5.1.0 up to and including 5.1.27; from 5.2.0 up to and including 5.2.29; from 5.3.0 up to and including 5.3.26; from 5.4.0 up to and including 5.4.24; from 5.5.0 up to and including 5.5.23; from 5.6.0 up to and including 5.6.22; from 5.7.0 up to and including 5.7.20; from 5.8.0 up to and including 5.8.18; from 5.9.0 up to and including 5.9.19; from 6.0.0 up to and including 6.0.17; from 6.1.0 up to and including 6.1.15; from 6.2.0 up to and including 6.2.14; from 6.3.0 up to and including 6.3.13; from 6.4.0 up to and including 6.4.13; from 6.5.0 up to and including 6.5.13; from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.9.6 up to and including 4.9.34
From 5.0.0 up to and including 5.0.30
From 5.1.0 up to and including 5.1.27
From 5.2.0 up to and including 5.2.29
From 5.3.0 up to and including 5.3.26
From 5.4.0 up to and including 5.4.24
From 5.5.0 up to and including 5.5.23
From 5.6.0 up to and including 5.6.22
From 5.7.0 up to and including 5.7.20
From 5.8.0 up to and including 5.8.18
From 5.9.0 up to and including 5.9.19
From 6.0.0 up to and including 6.0.17
From 6.1.0 up to and including 6.1.15
From 6.2.0 up to and including 6.2.14
From 6.3.0 up to and including 6.3.13
From 6.4.0 up to and including 6.4.13
From 6.5.0 up to and including 6.5.13
From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 4.9.6 - 7.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via Personal Data Erasure Request Email Addresses

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 6.7.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Categories Block

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone could use it to harm your site (from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 6.9.0 - 7.1.3 - Authenticated (Custom+) Incorrect Authorization to Read, Modify, and Delete Notes via REST API

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Unsafe Interactivity API Binding Properties

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone with a contributor account on your site could use it to harm your site (from 6.6.0 up to and including 6.6.10; from 6.7.0 up to and including 6.7.10; from 6.8.0 up to and including 6.8.11; from 6.9.0 up to and including 6.9.10; from 7.0.0 up to and including 7.0.7; from 7.1.0 up to and including 7.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress Core 6.6.0 - 7.1.3 - Authenticated (Contributor+) Clickjacking via Interactivity API Object Bindings

First reported

29 October 2026

Sources

Wordfence, seen 29 October 2026

This week

Someone could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Fixed in

7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

WordPress 7.1.4

First reported

28 October 2026

Sources

WordPress.org, seen 28 October 2026

This week

A stranger could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.38
From 4.8.0 up to and including 4.8.33
From 4.9.0 up to and including 4.9.34
From 5.0.0 up to and including 5.0.30
From 5.1.0 up to and including 5.1.27
From 5.2.0 up to and including 5.2.29
From 5.3.0 up to and including 5.3.26
From 5.4.0 up to and including 5.4.24
From 5.5.0 up to and including 5.5.23
From 5.6.0 up to and including 5.6.22
From 5.7.0 up to and including 5.7.20
From 5.8.0 up to and including 5.8.18
From 5.9.0 up to and including 5.9.19
From 6.0.0 up to and including 6.0.17
From 6.1.0 up to and including 6.1.15
From 6.2.0 up to and including 6.2.14
From 6.3.0 up to and including 6.3.13
From 6.4.0 up to and including 6.4.13
From 6.5.0 up to and including 6.5.13
From 6.6.0 up to and including 6.6.10
From 6.7.0 up to and including 6.7.10
From 6.8.0 up to and including 6.8.11
From 6.9.0 up to and including 6.9.10
From 7.0.0 up to and including 7.0.7
From 7.1.0 up to and including 7.1.3

Fixed in

4.7.39, 4.8.34, 4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Official ID

CVE-2026-119977

Report title

WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

First reported

28 October 2026

Sources

Wordfence, seen 28 October 2026

This week

Someone could use it to harm your site (from 7.1 up to and including 7.1.2; from 4.7.39 up to and including 7.1.3; from 4.7.0 up to and including 7.1.3; from 4.7 up to and including 7.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 7.1 up to and including 7.1.2
From 4.7.39 up to and including 7.1.3
From 4.7.0 up to and including 7.1.3
From 4.7 up to and including 7.1.3

Fixed in

7.1.4

What to do

If your site has an affected version, update WordPress to version 7.1.4 or newer.

Report title

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)

First reported

27 October 2026

Sources

Wordfence, seen 27 October 2026
Patchstack, seen 29 October 2026
Wordfence, seen 30 October 2026
The Hacker News, seen 30 October 2026
analyst207@mastodon.social, seen 30 October 2026
cloud@infosec.exchange, seen 31 October 2026
hacksgr@mastodon.social, seen 31 October 2026
linuxmint_hun@mastodon.social, seen 31 October 2026

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 4.7.0 up to and including 4.7.37; from 4.8.0 up to and including 4.8.32; from 4.9.0 up to and including 4.9.33; from 5.0.0 up to and including 5.0.29; from 5.1.0 up to and including 5.1.26; from 5.2.0 up to and including 5.2.28; from 5.3.0 up to and including 5.3.25; from 5.4.0 up to and including 5.4.23; from 5.5.0 up to and including 5.5.22; from 5.6.0 up to and including 5.6.21; from 5.7.0 up to and including 5.7.19; from 5.8.0 up to and including 5.8.17; from 5.9.0 up to and including 5.9.18; from 6.0.0 up to and including 6.0.16; from 6.1.0 up to and including 6.1.14; from 6.2.0 up to and including 6.2.13; from 6.3.0 up to and including 6.3.12; from 6.4.0 up to and including 6.4.12; from 6.5.0 up to and including 6.5.12; from 6.6.0 up to and including 6.6.9; from 6.7.0 up to and including 6.7.9; from 6.8.0 up to and including 6.8.10; from 6.9.0 up to and including 6.9.9; from 7.0.0 up to and including 7.0.6; from 7.1.0 up to and including 7.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.37
From 4.8.0 up to and including 4.8.32
From 4.9.0 up to and including 4.9.33
From 5.0.0 up to and including 5.0.29
From 5.1.0 up to and including 5.1.26
From 5.2.0 up to and including 5.2.28
From 5.3.0 up to and including 5.3.25
From 5.4.0 up to and including 5.4.23
From 5.5.0 up to and including 5.5.22
From 5.6.0 up to and including 5.6.21
From 5.7.0 up to and including 5.7.19
From 5.8.0 up to and including 5.8.17
From 5.9.0 up to and including 5.9.18
From 6.0.0 up to and including 6.0.16
From 6.1.0 up to and including 6.1.14
From 6.2.0 up to and including 6.2.13
From 6.3.0 up to and including 6.3.12
From 6.4.0 up to and including 6.4.12
From 6.5.0 up to and including 6.5.12
From 6.6.0 up to and including 6.6.9
From 6.7.0 up to and including 6.7.9
From 6.8.0 up to and including 6.8.10
From 6.9.0 up to and including 6.9.9
From 7.0.0 up to and including 7.0.6
From 7.1.0 up to and including 7.1.2

Fixed in

4.7.38, 4.8.33, 4.9.34, 5.0.30, 5.1.27, 5.2.29, 5.3.26, 5.4.24, 5.5.23, 5.6.22, 5.7.20, 5.8.18, 5.9.19, 6.0.17, 6.1.15, 6.2.14, 6.3.13, 6.4.13, 6.5.13, 6.6.10, 6.7.10, 6.8.11, 6.9.10, 7.0.7, 7.1.3

What to do

If your site has an affected version, update WordPress to version 7.1.3 or newer.

Report title

WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed

First reported

7 October 2026

Sources

Wordfence, seen 7 October 2026

This week

A stranger could see private information they should not see (from 4.7.0 up to and including 4.7.37; from 4.8.0 up to and including 4.8.32; from 4.9.0 up to and including 4.9.33; from 5.0.0 up to and including 5.0.29; from 5.1.0 up to and including 5.1.26; from 5.2.0 up to and including 5.2.28; from 5.3.0 up to and including 5.3.25; from 5.4.0 up to and including 5.4.23; from 5.5.0 up to and including 5.5.22; from 5.6.0 up to and including 5.6.21; from 5.7.0 up to and including 5.7.19; from 5.8.0 up to and including 5.8.17; from 5.9.0 up to and including 5.9.18; from 6.0.0 up to and including 6.0.16; from 6.1.0 up to and including 6.1.14; from 6.2.0 up to and including 6.2.13; from 6.3.0 up to and including 6.3.12; from 6.4.0 up to and including 6.4.12; from 6.5.0 up to and including 6.5.12; from 6.6.0 up to and including 6.6.9; from 6.7.0 up to and including 6.7.9; from 6.8.0 up to and including 6.8.10; from 6.9.0 up to and including 6.9.9; from 7.0.0 up to and including 7.0.6; from 7.1.0 up to and including 7.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.37
From 4.8.0 up to and including 4.8.32
From 4.9.0 up to and including 4.9.33
From 5.0.0 up to and including 5.0.29
From 5.1.0 up to and including 5.1.26
From 5.2.0 up to and including 5.2.28
From 5.3.0 up to and including 5.3.25
From 5.4.0 up to and including 5.4.23
From 5.5.0 up to and including 5.5.22
From 5.6.0 up to and including 5.6.21
From 5.7.0 up to and including 5.7.19
From 5.8.0 up to and including 5.8.17
From 5.9.0 up to and including 5.9.18
From 6.0.0 up to and including 6.0.16
From 6.1.0 up to and including 6.1.14
From 6.2.0 up to and including 6.2.13
From 6.3.0 up to and including 6.3.12
From 6.4.0 up to and including 6.4.12
From 6.5.0 up to and including 6.5.12
From 6.6.0 up to and including 6.6.9
From 6.7.0 up to and including 6.7.9
From 6.8.0 up to and including 6.8.10
From 6.9.0 up to and including 6.9.9
From 7.0.0 up to and including 7.0.6
From 7.1.0 up to and including 7.1.2

Fixed in

4.7.38, 4.8.33, 4.9.34, 5.0.30, 5.1.27, 5.2.29, 5.3.26, 5.4.24, 5.5.23, 5.6.22, 5.7.20, 5.8.18, 5.9.19, 6.0.17, 6.1.15, 6.2.14, 6.3.13, 6.4.13, 6.5.13, 6.6.10, 6.7.10, 6.8.11, 6.9.10, 7.0.7, 7.1.3

What to do

If your site has an affected version, update WordPress to version 7.1.3 or newer.

Official ID

CVE-2026-66666

Report title

WordPress Core 4.7.0 - 7.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds

First reported

7 October 2026

Sources

Wordfence, seen 7 October 2026

This week

Someone with an author account on your site could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.5.0 up to and including 6.5.12
From 6.6.0 up to and including 6.6.9
From 6.7.0 up to and including 6.7.9
From 6.8.0 up to and including 6.8.10
From 6.9.0 up to and including 6.9.9
From 7.0.0 up to and including 7.0.6
From 7.1.0 up to and including 7.1.2

Fixed in

6.5.13, 6.6.10, 6.7.10, 6.8.11, 6.9.10, 7.0.7, 7.1.3

What to do

If your site has an affected version, update WordPress to version 7.1.3 or newer.

Report title

WordPress Core 6.5.0 - 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export

First reported

7 October 2026

Sources

Wordfence, seen 7 October 2026

This week

Someone with an author account on your site could use it to harm your site (from 4.7.0 up to and including 4.7.37; from 4.8.0 up to and including 4.8.32; from 4.9.0 up to and including 4.9.33; from 5.0.0 up to and including 5.0.29; from 5.1.0 up to and including 5.1.26; from 5.2.0 up to and including 5.2.28; from 5.3.0 up to and including 5.3.25; from 5.4.0 up to and including 5.4.23; from 5.5.0 up to and including 5.5.22; from 5.6.0 up to and including 5.6.21; from 5.7.0 up to and including 5.7.19; from 5.8.0 up to and including 5.8.17; from 5.9.0 up to and including 5.9.18; from 6.0.0 up to and including 6.0.16; from 6.1.0 up to and including 6.1.14; from 6.2.0 up to and including 6.2.13; from 6.3.0 up to and including 6.3.12; from 6.4.0 up to and including 6.4.12; from 6.5.0 up to and including 6.5.12; from 6.6.0 up to and including 6.6.9; from 6.7.0 up to and including 6.7.9; from 6.8.0 up to and including 6.8.10; from 6.9.0 up to and including 6.9.9; from 7.0.0 up to and including 7.0.6; from 7.1.0 up to and including 7.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.37
From 4.8.0 up to and including 4.8.32
From 4.9.0 up to and including 4.9.33
From 5.0.0 up to and including 5.0.29
From 5.1.0 up to and including 5.1.26
From 5.2.0 up to and including 5.2.28
From 5.3.0 up to and including 5.3.25
From 5.4.0 up to and including 5.4.23
From 5.5.0 up to and including 5.5.22
From 5.6.0 up to and including 5.6.21
From 5.7.0 up to and including 5.7.19
From 5.8.0 up to and including 5.8.17
From 5.9.0 up to and including 5.9.18
From 6.0.0 up to and including 6.0.16
From 6.1.0 up to and including 6.1.14
From 6.2.0 up to and including 6.2.13
From 6.3.0 up to and including 6.3.12
From 6.4.0 up to and including 6.4.12
From 6.5.0 up to and including 6.5.12
From 6.6.0 up to and including 6.6.9
From 6.7.0 up to and including 6.7.9
From 6.8.0 up to and including 6.8.10
From 6.9.0 up to and including 6.9.9
From 7.0.0 up to and including 7.0.6
From 7.1.0 up to and including 7.1.2

Fixed in

4.7.38, 4.8.33, 4.9.34, 5.0.30, 5.1.27, 5.2.29, 5.3.26, 5.4.24, 5.5.23, 5.6.22, 5.7.20, 5.8.18, 5.9.19, 6.0.17, 6.1.15, 6.2.14, 6.3.13, 6.4.13, 6.5.13, 6.6.10, 6.7.10, 6.8.11, 6.9.10, 7.0.7, 7.1.3

What to do

If your site has an affected version, update WordPress to version 7.1.3 or newer.

Report title

WordPress Core 4.7.0 - 7.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API

First reported

7 October 2026

Sources

Wordfence, seen 7 October 2026

This week

Someone with a contributor account on your site could slow down or crash your site (from 4.7.0 up to and including 4.7.37; from 4.8.0 up to and including 4.8.32; from 4.9.0 up to and including 4.9.33; from 5.0.0 up to and including 5.0.29; from 5.1.0 up to and including 5.1.26; from 5.2.0 up to and including 5.2.28; from 5.3.0 up to and including 5.3.25; from 5.4.0 up to and including 5.4.23; from 5.5.0 up to and including 5.5.22; from 5.6.0 up to and including 5.6.21; from 5.7.0 up to and including 5.7.19; from 5.8.0 up to and including 5.8.17; from 5.9.0 up to and including 5.9.18; from 6.0.0 up to and including 6.0.16; from 6.1.0 up to and including 6.1.14; from 6.2.0 up to and including 6.2.13; from 6.3.0 up to and including 6.3.12; from 6.4.0 up to and including 6.4.12; from 6.5.0 up to and including 6.5.12; from 6.6.0 up to and including 6.6.9; from 6.7.0 up to and including 6.7.9; from 6.8.0 up to and including 6.8.10; from 6.9.0 up to and including 6.9.9; from 7.0.0 up to and including 7.0.6; from 7.1.0 up to and including 7.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.37
From 4.8.0 up to and including 4.8.32
From 4.9.0 up to and including 4.9.33
From 5.0.0 up to and including 5.0.29
From 5.1.0 up to and including 5.1.26
From 5.2.0 up to and including 5.2.28
From 5.3.0 up to and including 5.3.25
From 5.4.0 up to and including 5.4.23
From 5.5.0 up to and including 5.5.22
From 5.6.0 up to and including 5.6.21
From 5.7.0 up to and including 5.7.19
From 5.8.0 up to and including 5.8.17
From 5.9.0 up to and including 5.9.18
From 6.0.0 up to and including 6.0.16
From 6.1.0 up to and including 6.1.14
From 6.2.0 up to and including 6.2.13
From 6.3.0 up to and including 6.3.12
From 6.4.0 up to and including 6.4.12
From 6.5.0 up to and including 6.5.12
From 6.6.0 up to and including 6.6.9
From 6.7.0 up to and including 6.7.9
From 6.8.0 up to and including 6.8.10
From 6.9.0 up to and including 6.9.9
From 7.0.0 up to and including 7.0.6
From 7.1.0 up to and including 7.1.2

Fixed in

4.7.38, 4.8.33, 4.9.34, 5.0.30, 5.1.27, 5.2.29, 5.3.26, 5.4.24, 5.5.23, 5.6.22, 5.7.20, 5.8.18, 5.9.19, 6.0.17, 6.1.15, 6.2.14, 6.3.13, 6.4.13, 6.5.13, 6.6.10, 6.7.10, 6.8.11, 6.9.10, 7.0.7, 7.1.3

What to do

If your site has an affected version, update WordPress to version 7.1.3 or newer.

Report title

WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details

First reported

7 October 2026

Sources

Wordfence, seen 7 October 2026

This week

Someone could use it to harm your site (from 4.7.0 up to and including 4.7.37; from 4.8.0 up to and including 4.8.32; from 4.9.0 up to and including 4.9.33; from 5.0.0 up to and including 5.0.29; from 5.1.0 up to and including 5.1.26; from 5.2.0 up to and including 5.2.28; from 5.3.0 up to and including 5.3.25; from 5.4.0 up to and including 5.4.23; from 5.5.0 up to and including 5.5.22; from 5.6.0 up to and including 5.6.21; from 5.7.0 up to and including 5.7.19; from 5.8.0 up to and including 5.8.17; from 5.9.0 up to and including 5.9.18; from 6.0.0 up to and including 6.0.16; from 6.1.0 up to and including 6.1.14; from 6.2.0 up to and including 6.2.13; from 6.3.0 up to and including 6.3.12; from 6.4.0 up to and including 6.4.12; from 6.5.0 up to and including 6.5.12; from 6.6.0 up to and including 6.6.9; from 6.7.0 up to and including 6.7.9; from 6.8.0 up to and including 6.8.10; from 6.9.0 up to and including 6.9.9; from 7.0.0 up to and including 7.0.6; from 7.1.0 up to and including 7.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.37
From 4.8.0 up to and including 4.8.32
From 4.9.0 up to and including 4.9.33
From 5.0.0 up to and including 5.0.29
From 5.1.0 up to and including 5.1.26
From 5.2.0 up to and including 5.2.28
From 5.3.0 up to and including 5.3.25
From 5.4.0 up to and including 5.4.23
From 5.5.0 up to and including 5.5.22
From 5.6.0 up to and including 5.6.21
From 5.7.0 up to and including 5.7.19
From 5.8.0 up to and including 5.8.17
From 5.9.0 up to and including 5.9.18
From 6.0.0 up to and including 6.0.16
From 6.1.0 up to and including 6.1.14
From 6.2.0 up to and including 6.2.13
From 6.3.0 up to and including 6.3.12
From 6.4.0 up to and including 6.4.12
From 6.5.0 up to and including 6.5.12
From 6.6.0 up to and including 6.6.9
From 6.7.0 up to and including 6.7.9
From 6.8.0 up to and including 6.8.10
From 6.9.0 up to and including 6.9.9
From 7.0.0 up to and including 7.0.6
From 7.1.0 up to and including 7.1.2

Fixed in

4.7.38, 4.8.33, 4.9.34, 5.0.30, 5.1.27, 5.2.29, 5.3.26, 5.4.24, 5.5.23, 5.6.22, 5.7.20, 5.8.18, 5.9.19, 6.0.17, 6.1.15, 6.2.14, 6.3.13, 6.4.13, 6.5.13, 6.6.10, 6.7.10, 6.8.11, 6.9.10, 7.0.7, 7.1.3

What to do

If your site has an affected version, update WordPress to version 7.1.3 or newer.

Report title

WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type

First reported

7 October 2026

Sources

Wordfence, seen 7 October 2026

This week

A stranger could plant harmful code that runs for your visitors or admins (from 7.1.0 up to and including 7.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 7.1.0 up to and including 7.1.2

Fixed in

7.1.3

What to do

If your site has an affected version, update WordPress to version 7.1.3 or newer.

Report title

WordPress Core 7.1 - 7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments

First reported

6 October 2026

Sources

Wordfence, seen 6 October 2026

This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 6.6.7; from 6.7 up to and including 6.7.7; from 6.8 up to and including 6.8.8; from 6.9 up to and including 6.9.7; from 7.0 up to and including 7.0.4; from 7.1 up to and including 7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 6.6.7
From 6.7 up to and including 6.7.7
From 6.8 up to and including 6.8.8
From 6.9 up to and including 6.9.7
From 7.0 up to and including 7.0.4
From 7.1 up to and including 7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

What to do

If your site has an affected version, update WordPress to version 7.1.1 or newer.

Official ID

CVE-2026-93485

Report title

WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling

First reported

17 September 2026

Sources

Wordfence, seen 17 September 2026

This week

Someone could do things on your site they should not be allowed to (up to and including 6.6.7; from 6.7 up to and including 6.7.7; from 6.8 up to and including 6.8.8; from 6.9 up to and including 6.9.7; from 7.0 up to and including 7.0.4; from 7.1 up to and including 7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 6.6.7
From 6.7 up to and including 6.7.7
From 6.8 up to and including 6.8.8
From 6.9 up to and including 6.9.7
From 7.0 up to and including 7.0.4
From 7.1 up to and including 7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

What to do

If your site has an affected version, update WordPress to version 7.1.1 or newer.

Report title

WordPress Core <= 7.1 - Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)

First reported

17 September 2026

Sources

Wordfence, seen 17 September 2026

This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins (up to and including 6.6.7; from 6.7 up to and including 6.7.7; from 6.8 up to and including 6.8.8; from 6.9 up to and including 6.9.7; from 7.0 up to and including 7.0.4; from 7.1 up to and including 7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 6.6.7
From 6.7 up to and including 6.7.7
From 6.8 up to and including 6.8.8
From 6.9 up to and including 6.9.7
From 7.0 up to and including 7.0.4
From 7.1 up to and including 7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

What to do

If your site has an affected version, update WordPress to version 7.1.1 or newer.

Report title

WordPress Core <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data

First reported

17 September 2026

Sources

Wordfence, seen 17 September 2026

This week

Someone with a contributor account on your site could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.8 up to and including 6.6.7
From 6.7 up to and including 6.7.7
From 6.8 up to and including 6.8.8
From 6.9 up to and including 6.9.7
From 7.0 up to and including 7.0.4
From 7.1 up to and including 7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

What to do

If your site has an affected version, update WordPress to version 7.1.1 or newer.

Report title

WordPress Core <= 7.1 - Authenticated (Contributor+) Path Traversal via REST Templates Controller

First reported

17 September 2026

Sources

Wordfence, seen 17 September 2026

This week

Someone with a contributor account on your site could use it to harm your site (up to and including 6.6.7; from 6.7 up to and including 6.7.7; from 6.8 up to and including 6.8.8; from 6.9 up to and including 6.9.7; from 7.0 up to and including 7.0.4; from 7.1 up to and including 7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 6.6.7
From 6.7 up to and including 6.7.7
From 6.8 up to and including 6.8.8
From 6.9 up to and including 6.9.7
From 7.0 up to and including 7.0.4
From 7.1 up to and including 7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

What to do

If your site has an affected version, update WordPress to version 7.1.1 or newer.

Report title

WordPress Core <= 7.1 - Authenticated (Contributor+) Information Exposure via Sample Permalink AJAX Actions

First reported

17 September 2026

Sources

Wordfence, seen 17 September 2026

This week

Someone with an author account on your site could do things on your site they should not be allowed to (up to and including 6.6.7; from 6.7 up to and including 6.7.7; from 6.8 up to and including 6.8.8; from 6.9 up to and including 6.9.7; from 7.0 up to and including 7.0.4; from 7.1 up to and including 7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 6.6.7
From 6.7 up to and including 6.7.7
From 6.8 up to and including 6.8.8
From 6.9 up to and including 6.9.7
From 7.0 up to and including 7.0.4
From 7.1 up to and including 7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

What to do

If your site has an affected version, update WordPress to version 7.1.1 or newer.

Report title

WordPress Core <= 7.1 - Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API

First reported

17 September 2026

Sources

Wordfence, seen 17 September 2026

This week

Someone with a contributor account on your site could use it to harm your site (up to and including 6.6.7; from 6.7 up to and including 6.7.7; from 6.8 up to and including 6.8.8; from 6.9 up to and including 6.9.7; from 7.0 up to and including 7.0.4; from 7.1 up to and including 7.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 6.6.7
From 6.7 up to and including 6.7.7
From 6.8 up to and including 6.8.8
From 6.9 up to and including 6.9.7
From 7.0 up to and including 7.0.4
From 7.1 up to and including 7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

What to do

If your site has an affected version, update WordPress to version 7.1.1 or newer.

Report title

WordPress Core <= 7.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Post Overwrite

First reported

17 September 2026

Sources

Wordfence, seen 17 September 2026

This week

Someone with an author account on your site could use it to harm your site (up to and including 6.6.7; from 6.7 up to and including 6.7.7; from 6.8 up to and including 6.8.8; from 6.9 up to and including 6.9.7; from 7.0 up to and including 7.0.4; from 7.1 up to and including 7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 6.6.7
From 6.7 up to and including 6.7.7
From 6.8 up to and including 6.8.8
From 6.9 up to and including 6.9.7
From 7.0 up to and including 7.0.4
From 7.1 up to and including 7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

What to do

If your site has an affected version, update WordPress to version 7.1.1 or newer.

Report title

WordPress Core <= 7.1 - Authenticated (Author+) Information Exposure via attachment_submitbox_metadata()

First reported

17 September 2026

Sources

Wordfence, seen 17 September 2026

This week

Someone could use it to harm your site (up to and including 6.6.7; from 6.7 up to and including 6.7.7; from 6.8 up to and including 6.8.8; from 6.9 up to and including 6.9.7; from 7.0 up to and including 7.0.4; from 7.1 up to and including 7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 6.6.7
From 6.7 up to and including 6.7.7
From 6.8 up to and including 6.8.8
From 6.9 up to and including 6.9.7
From 7.0 up to and including 7.0.4
From 7.1 up to and including 7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

What to do

If your site has an affected version, update WordPress to version 7.1.1 or newer.

Report title

WordPress Core <= 7.1 - Forced Theme Install/Preview and Selector Injection via Theme Installer Route

First reported

17 September 2026

Sources

Wordfence, seen 17 September 2026

This week

Someone could use it to harm your site (from 6.7 up to and including 6.7.7; from 6.8 up to and including 6.8.8; from 6.9 up to and including 6.9.7; from 7.0 up to and including 7.0.4; from 7.1 up to and including 7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.7 up to and including 6.7.7
From 6.8 up to and including 6.8.8
From 6.9 up to and including 6.9.7
From 7.0 up to and including 7.0.4
From 7.1 up to and including 7.1

Fixed in

6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

What to do

If your site has an affected version, update WordPress to version 7.1.1 or newer.

Report title

WordPress Core <= 7.1 - HTML API set_modifiable_text() Comment Boundary Break

First reported

17 September 2026

Sources

Wordfence, seen 17 September 2026

This week

Someone who already has an admin account could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 6.6.7
From 6.7 up to and including 6.7.7
From 6.8 up to and including 6.8.8
From 6.9 up to and including 6.9.7
From 7.0 up to and including 7.0.4
From 7.1 up to and including 7.1

Fixed in

6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5, 7.1.1

What to do

If your site has an affected version, update WordPress to version 7.1.1 or newer.

Report title

WordPress Core <= 7.1 - Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite)

First reported

17 September 2026

Sources

Wordfence, seen 17 September 2026

This week

Someone with an author account on your site could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.34
From 4.8.0 up to and including 4.8.29
From 4.9.0 up to and including 4.9.30
From 5.0.0 up to and including 5.0.26
From 5.1.0 up to and including 5.1.23
From 5.2.0 up to and including 5.2.25
From 5.3.0 up to and including 5.3.22
From 5.4.0 up to and including 5.4.20
From 5.5.0 up to and including 5.5.19
From 5.6.0 up to and including 5.6.18
From 5.7.0 up to and including 5.7.16
From 5.8.0 up to and including 5.8.14
From 5.9.0 up to and including 5.9.15
From 6.0.0 up to and including 6.0.13
From 6.1.0 up to and including 6.1.11
From 6.2.0 up to and including 6.2.10
From 6.3.0 up to and including 6.3.9
From 6.4.0 up to and including 6.4.9
From 6.5.0 up to and including 6.5.9
From 6.6.0 up to and including 6.6.6
From 6.7.0 up to and including 6.7.6
From 6.8.0 up to and including 6.8.7
From 6.9.0 up to and including 6.9.6
From 7.0.0 up to and including 7.0.3

Fixed in

4.7.35, 4.8.30, 4.9.31, 5.0.27, 5.1.24, 5.2.26, 5.3.23, 5.4.21, 5.5.20, 5.6.19, 5.7.17, 5.8.15, 5.9.16, 6.0.14, 6.1.12, 6.2.11, 6.3.10, 6.4.10, 6.5.10, 6.6.7, 6.7.7, 6.8.8, 6.9.7, 7.0.4

What to do

If your site has an affected version, update WordPress to version 7.0.4 or newer.

Official ID

CVE-2026-65640

Report title

WordPress Core <= 7.0.3 - Authenticated (Author+) Remote Code Execution via Malicious File Upload

First reported

12 August 2026

Sources

Wordfence, seen 12 August 2026

This week

A stranger could plant harmful code that runs for your visitors or admins (from 4.7.0 up to and including 4.7.33; from 4.8.0 up to and including 4.8.28; from 4.9.0 up to and including 4.9.29; from 5.0.0 up to and including 5.0.25; from 5.1.0 up to and including 5.1.22; from 5.2.0 up to and including 5.2.24; from 5.3.0 up to and including 5.3.21; from 5.4.0 up to and including 5.4.19; from 5.5.0 up to and including 5.5.18; from 5.6.0 up to and including 5.6.17; from 5.7.0 up to and including 5.7.15; from 5.8.0 up to and including 5.8.13; from 5.9.0 up to and including 5.9.13; from 6.0.0 up to and including 6.0.12; from 6.1.0 up to and including 6.1.10; from 6.2.0 up to and including 6.2.9; from 6.3.0 up to and including 6.3.8; from 6.4.0 up to and including 6.4.8; from 6.5.0 up to and including 6.5.8; from 6.6.0 up to and including 6.6.5; from 6.7.0 up to and including 6.7.5; from 6.8.0 up to and including 6.8.6; from 6.9.0 up to and including 6.9.5; from 7.0.0 up to and including 7.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.33
From 4.8.0 up to and including 4.8.28
From 4.9.0 up to and including 4.9.29
From 5.0.0 up to and including 5.0.25
From 5.1.0 up to and including 5.1.22
From 5.2.0 up to and including 5.2.24
From 5.3.0 up to and including 5.3.21
From 5.4.0 up to and including 5.4.19
From 5.5.0 up to and including 5.5.18
From 5.6.0 up to and including 5.6.17
From 5.7.0 up to and including 5.7.15
From 5.8.0 up to and including 5.8.13
From 5.9.0 up to and including 5.9.13
From 6.0.0 up to and including 6.0.12
From 6.1.0 up to and including 6.1.10
From 6.2.0 up to and including 6.2.9
From 6.3.0 up to and including 6.3.8
From 6.4.0 up to and including 6.4.8
From 6.5.0 up to and including 6.5.8
From 6.6.0 up to and including 6.6.5
From 6.7.0 up to and including 6.7.5
From 6.8.0 up to and including 6.8.6
From 6.9.0 up to and including 6.9.5
From 7.0.0 up to and including 7.0.2

Fixed in

4.7.34, 4.8.29, 4.9.30, 5.0.26, 5.1.23, 5.2.25, 5.3.22, 5.4.20, 5.5.19, 5.6.18, 5.7.16, 5.8.14, 5.9.14, 6.0.13, 6.1.11, 6.2.10, 6.3.9, 6.4.9, 6.5.9, 6.6.6, 6.7.6, 6.8.7, 6.9.6, 7.0.3

What to do

If your site has an affected version, update WordPress to version 7.0.3 or newer.

Official ID

CVE-2026-64638

Report title

WordPress Core <= 7.0.2 - Unauthenticated Reflected Cross-Site Scripting via log Parameter

First reported

8 August 2026

Sources

Wordfence, seen 8 August 2026

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 4.7.0 up to and including 4.7.33; from 4.8.0 up to and including 4.8.28; from 4.9.0 up to and including 4.9.29; from 5.0.0 up to and including 5.0.25; from 5.1.0 up to and including 5.1.22; from 5.2.0 up to and including 5.2.24; from 5.3.0 up to and including 5.3.21; from 5.4.0 up to and including 5.4.19; from 5.5.0 up to and including 5.5.18; from 5.6.0 up to and including 5.6.17; from 5.7.0 up to and including 5.7.15; from 5.8.0 up to and including 5.8.13; from 5.9.0 up to and including 5.9.13; from 6.0.0 up to and including 6.0.12; from 6.1.0 up to and including 6.1.10; from 6.2.0 up to and including 6.2.9; from 6.3.0 up to and including 6.3.8; from 6.4.0 up to and including 6.4.8; from 6.5.0 up to and including 6.5.8; from 6.6.0 up to and including 6.6.5; from 6.7.0 up to and including 6.7.5; from 6.8.0 up to and including 6.8.6; from 6.9.0 up to and including 6.9.5; from 7.0.0 up to and including 7.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.33
From 4.8.0 up to and including 4.8.28
From 4.9.0 up to and including 4.9.29
From 5.0.0 up to and including 5.0.25
From 5.1.0 up to and including 5.1.22
From 5.2.0 up to and including 5.2.24
From 5.3.0 up to and including 5.3.21
From 5.4.0 up to and including 5.4.19
From 5.5.0 up to and including 5.5.18
From 5.6.0 up to and including 5.6.17
From 5.7.0 up to and including 5.7.15
From 5.8.0 up to and including 5.8.13
From 5.9.0 up to and including 5.9.13
From 6.0.0 up to and including 6.0.12
From 6.1.0 up to and including 6.1.10
From 6.2.0 up to and including 6.2.9
From 6.3.0 up to and including 6.3.8
From 6.4.0 up to and including 6.4.8
From 6.5.0 up to and including 6.5.8
From 6.6.0 up to and including 6.6.5
From 6.7.0 up to and including 6.7.5
From 6.8.0 up to and including 6.8.6
From 6.9.0 up to and including 6.9.5
From 7.0.0 up to and including 7.0.2

Fixed in

4.7.34, 4.8.29, 4.9.30, 5.0.26, 5.1.23, 5.2.25, 5.3.22, 5.4.20, 5.5.19, 5.6.18, 5.7.16, 5.8.14, 5.9.14, 6.0.13, 6.1.11, 6.2.10, 6.3.9, 6.4.9, 6.5.9, 6.6.6, 6.7.6, 6.8.7, 6.9.6, 7.0.3

What to do

If your site has an affected version, update WordPress to version 7.0.3 or newer.

Report title

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element

First reported

8 August 2026

Sources

Wordfence, seen 8 August 2026

This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (from 4.7.0 up to and including 4.7.33; from 4.8.0 up to and including 4.8.28; from 4.9.0 up to and including 4.9.29; from 5.0.0 up to and including 5.0.25; from 5.1.0 up to and including 5.1.22; from 5.2.0 up to and including 5.2.24; from 5.3.0 up to and including 5.3.21; from 5.4.0 up to and including 5.4.19; from 5.5.0 up to and including 5.5.18; from 5.6.0 up to and including 5.6.17; from 5.7.0 up to and including 5.7.15; from 5.8.0 up to and including 5.8.13; from 5.9.0 up to and including 5.9.13; from 6.0.0 up to and including 6.0.12; from 6.1.0 up to and including 6.1.10; from 6.2.0 up to and including 6.2.9; from 6.3.0 up to and including 6.3.8; from 6.4.0 up to and including 6.4.8; from 6.5.0 up to and including 6.5.8; from 6.6.0 up to and including 6.6.5; from 6.7.0 up to and including 6.7.5; from 6.8.0 up to and including 6.8.6; from 6.9.0 up to and including 6.9.5; from 7.0.0 up to and including 7.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.33
From 4.8.0 up to and including 4.8.28
From 4.9.0 up to and including 4.9.29
From 5.0.0 up to and including 5.0.25
From 5.1.0 up to and including 5.1.22
From 5.2.0 up to and including 5.2.24
From 5.3.0 up to and including 5.3.21
From 5.4.0 up to and including 5.4.19
From 5.5.0 up to and including 5.5.18
From 5.6.0 up to and including 5.6.17
From 5.7.0 up to and including 5.7.15
From 5.8.0 up to and including 5.8.13
From 5.9.0 up to and including 5.9.13
From 6.0.0 up to and including 6.0.12
From 6.1.0 up to and including 6.1.10
From 6.2.0 up to and including 6.2.9
From 6.3.0 up to and including 6.3.8
From 6.4.0 up to and including 6.4.8
From 6.5.0 up to and including 6.5.8
From 6.6.0 up to and including 6.6.5
From 6.7.0 up to and including 6.7.5
From 6.8.0 up to and including 6.8.6
From 6.9.0 up to and including 6.9.5
From 7.0.0 up to and including 7.0.2

Fixed in

4.7.34, 4.8.29, 4.9.30, 5.0.26, 5.1.23, 5.2.25, 5.3.22, 5.4.20, 5.5.19, 5.6.18, 5.7.16, 5.8.14, 5.9.14, 6.0.13, 6.1.11, 6.2.10, 6.3.9, 6.4.9, 6.5.9, 6.6.6, 6.7.6, 6.8.7, 6.9.6, 7.0.3

What to do

If your site has an affected version, update WordPress to version 7.0.3 or newer.

Report title

WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite

First reported

8 August 2026

Sources

Wordfence, seen 8 August 2026

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 4.7.0 up to and including 4.7.33; from 4.8.0 up to and including 4.8.28; from 4.9.0 up to and including 4.9.29; from 5.0.0 up to and including 5.0.25; from 5.1.0 up to and including 5.1.22; from 5.2.0 up to and including 5.2.24; from 5.3.0 up to and including 5.3.21; from 5.4.0 up to and including 5.4.19; from 5.5.0 up to and including 5.5.18; from 5.6.0 up to and including 5.6.17; from 5.7.0 up to and including 5.7.15; from 5.8.0 up to and including 5.8.13; from 5.9.0 up to and including 5.9.13; from 6.0.0 up to and including 6.0.12; from 6.1.0 up to and including 6.1.10; from 6.2.0 up to and including 6.2.9; from 6.3.0 up to and including 6.3.8; from 6.4.0 up to and including 6.4.8; from 6.5.0 up to and including 6.5.8; from 6.6.0 up to and including 6.6.5; from 6.7.0 up to and including 6.7.5; from 6.8.0 up to and including 6.8.6; from 6.9.0 up to and including 6.9.5; from 7.0.0 up to and including 7.0.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.33
From 4.8.0 up to and including 4.8.28
From 4.9.0 up to and including 4.9.29
From 5.0.0 up to and including 5.0.25
From 5.1.0 up to and including 5.1.22
From 5.2.0 up to and including 5.2.24
From 5.3.0 up to and including 5.3.21
From 5.4.0 up to and including 5.4.19
From 5.5.0 up to and including 5.5.18
From 5.6.0 up to and including 5.6.17
From 5.7.0 up to and including 5.7.15
From 5.8.0 up to and including 5.8.13
From 5.9.0 up to and including 5.9.13
From 6.0.0 up to and including 6.0.12
From 6.1.0 up to and including 6.1.10
From 6.2.0 up to and including 6.2.9
From 6.3.0 up to and including 6.3.8
From 6.4.0 up to and including 6.4.8
From 6.5.0 up to and including 6.5.8
From 6.6.0 up to and including 6.6.5
From 6.7.0 up to and including 6.7.5
From 6.8.0 up to and including 6.8.6
From 6.9.0 up to and including 6.9.5
From 7.0.0 up to and including 7.0.2

Fixed in

4.7.34, 4.8.29, 4.9.30, 5.0.26, 5.1.23, 5.2.25, 5.3.22, 5.4.20, 5.5.19, 5.6.18, 5.7.16, 5.8.14, 5.9.14, 6.0.13, 6.1.11, 6.2.10, 6.3.9, 6.4.9, 6.5.9, 6.6.6, 6.7.6, 6.8.7, 6.9.6, 7.0.3

What to do

If your site has an affected version, update WordPress to version 7.0.3 or newer.

Official ID

CVE-2026-114570

Report title

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

First reported

8 August 2026

Sources

Wordfence, seen 8 August 2026

This week

A stranger could see private information they should not see (from 4.7.0 up to and including 4.7.33; from 4.8.0 up to and including 4.8.28; from 4.9.0 up to and including 4.9.29; from 5.0.0 up to and including 5.0.25; from 5.1.0 up to and including 5.1.22; from 5.2.0 up to and including 5.2.24; from 5.3.0 up to and including 5.3.21; from 5.4.0 up to and including 5.4.19; from 5.5.0 up to and including 5.5.18; from 5.6.0 up to and including 5.6.17; from 5.7.0 up to and including 5.7.15; from 5.8.0 up to and including 5.8.13; from 5.9.0 up to and including 5.9.13; from 6.0.0 up to and including 6.0.12; from 6.1.0 up to and including 6.1.10; from 6.2.0 up to and including 6.2.9; from 6.3.0 up to and including 6.3.8; from 6.4.0 up to and including 6.4.8; from 6.5.0 up to and including 6.5.8; from 6.6.0 up to and including 6.6.5; from 6.7.0 up to and including 6.7.5; from 6.8.0 up to and including 6.8.6; from 6.9.0 up to and including 6.9.5; from 7.0.0 up to and including 7.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.33
From 4.8.0 up to and including 4.8.28
From 4.9.0 up to and including 4.9.29
From 5.0.0 up to and including 5.0.25
From 5.1.0 up to and including 5.1.22
From 5.2.0 up to and including 5.2.24
From 5.3.0 up to and including 5.3.21
From 5.4.0 up to and including 5.4.19
From 5.5.0 up to and including 5.5.18
From 5.6.0 up to and including 5.6.17
From 5.7.0 up to and including 5.7.15
From 5.8.0 up to and including 5.8.13
From 5.9.0 up to and including 5.9.13
From 6.0.0 up to and including 6.0.12
From 6.1.0 up to and including 6.1.10
From 6.2.0 up to and including 6.2.9
From 6.3.0 up to and including 6.3.8
From 6.4.0 up to and including 6.4.8
From 6.5.0 up to and including 6.5.8
From 6.6.0 up to and including 6.6.5
From 6.7.0 up to and including 6.7.5
From 6.8.0 up to and including 6.8.6
From 6.9.0 up to and including 6.9.5
From 7.0.0 up to and including 7.0.2

Fixed in

4.7.34, 4.8.29, 4.9.30, 5.0.26, 5.1.23, 5.2.25, 5.3.22, 5.4.20, 5.5.19, 5.6.18, 5.7.16, 5.8.14, 5.9.14, 6.0.13, 6.1.11, 6.2.10, 6.3.9, 6.4.9, 6.5.9, 6.6.6, 6.7.6, 6.8.7, 6.9.6, 7.0.3

What to do

If your site has an affected version, update WordPress to version 7.0.3 or newer.

Report title

WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds

First reported

8 August 2026

Sources

Wordfence, seen 8 August 2026

This week

Someone with an author account on your site could use it to harm your site (from 4.7.0 up to and including 4.7.33; from 4.8.0 up to and including 4.8.28; from 4.9.0 up to and including 4.9.29; from 5.0.0 up to and including 5.0.25; from 5.1.0 up to and including 5.1.22; from 5.2.0 up to and including 5.2.24; from 5.3.0 up to and including 5.3.21; from 5.4.0 up to and including 5.4.19; from 5.5.0 up to and including 5.5.18; from 5.6.0 up to and including 5.6.17; from 5.7.0 up to and including 5.7.15; from 5.8.0 up to and including 5.8.13; from 5.9.0 up to and including 5.9.13; from 6.0.0 up to and including 6.0.12; from 6.1.0 up to and including 6.1.10; from 6.2.0 up to and including 6.2.9; from 6.3.0 up to and including 6.3.8; from 6.4.0 up to and including 6.4.8; from 6.5.0 up to and including 6.5.8; from 6.6.0 up to and including 6.6.5; from 6.7.0 up to and including 6.7.5; from 6.8.0 up to and including 6.8.6; from 6.9.0 up to and including 6.9.5; from 7.0.0 up to and including 7.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.33
From 4.8.0 up to and including 4.8.28
From 4.9.0 up to and including 4.9.29
From 5.0.0 up to and including 5.0.25
From 5.1.0 up to and including 5.1.22
From 5.2.0 up to and including 5.2.24
From 5.3.0 up to and including 5.3.21
From 5.4.0 up to and including 5.4.19
From 5.5.0 up to and including 5.5.18
From 5.6.0 up to and including 5.6.17
From 5.7.0 up to and including 5.7.15
From 5.8.0 up to and including 5.8.13
From 5.9.0 up to and including 5.9.13
From 6.0.0 up to and including 6.0.12
From 6.1.0 up to and including 6.1.10
From 6.2.0 up to and including 6.2.9
From 6.3.0 up to and including 6.3.8
From 6.4.0 up to and including 6.4.8
From 6.5.0 up to and including 6.5.8
From 6.6.0 up to and including 6.6.5
From 6.7.0 up to and including 6.7.5
From 6.8.0 up to and including 6.8.6
From 6.9.0 up to and including 6.9.5
From 7.0.0 up to and including 7.0.2

Fixed in

4.7.34, 4.8.29, 4.9.30, 5.0.26, 5.1.23, 5.2.25, 5.3.22, 5.4.20, 5.5.19, 5.6.18, 5.7.16, 5.8.14, 5.9.14, 6.0.13, 6.1.11, 6.2.10, 6.3.9, 6.4.9, 6.5.9, 6.6.6, 6.7.6, 6.8.7, 6.9.6, 7.0.3

What to do

If your site has an affected version, update WordPress to version 7.0.3 or newer.

Report title

WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection

First reported

8 August 2026

Sources

Wordfence, seen 8 August 2026

This week

Anyone with an account on your site, even a basic one could use it to harm your site (from 4.7.0 up to and including 4.7.33; from 4.8.0 up to and including 4.8.28; from 4.9.0 up to and including 4.9.29; from 5.0.0 up to and including 5.0.25; from 5.1.0 up to and including 5.1.22; from 5.2.0 up to and including 5.2.24; from 5.3.0 up to and including 5.3.21; from 5.4.0 up to and including 5.4.19; from 5.5.0 up to and including 5.5.18; from 5.6.0 up to and including 5.6.17; from 5.7.0 up to and including 5.7.15; from 5.8.0 up to and including 5.8.13; from 5.9.0 up to and including 5.9.13; from 6.0.0 up to and including 6.0.12; from 6.1.0 up to and including 6.1.10; from 6.2.0 up to and including 6.2.9; from 6.3.0 up to and including 6.3.8; from 6.4.0 up to and including 6.4.8; from 6.5.0 up to and including 6.5.8; from 6.6.0 up to and including 6.6.5; from 6.7.0 up to and including 6.7.5; from 6.8.0 up to and including 6.8.6; from 6.9.0 up to and including 6.9.5; from 7.0.0 up to and including 7.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.33
From 4.8.0 up to and including 4.8.28
From 4.9.0 up to and including 4.9.29
From 5.0.0 up to and including 5.0.25
From 5.1.0 up to and including 5.1.22
From 5.2.0 up to and including 5.2.24
From 5.3.0 up to and including 5.3.21
From 5.4.0 up to and including 5.4.19
From 5.5.0 up to and including 5.5.18
From 5.6.0 up to and including 5.6.17
From 5.7.0 up to and including 5.7.15
From 5.8.0 up to and including 5.8.13
From 5.9.0 up to and including 5.9.13
From 6.0.0 up to and including 6.0.12
From 6.1.0 up to and including 6.1.10
From 6.2.0 up to and including 6.2.9
From 6.3.0 up to and including 6.3.8
From 6.4.0 up to and including 6.4.8
From 6.5.0 up to and including 6.5.8
From 6.6.0 up to and including 6.6.5
From 6.7.0 up to and including 6.7.5
From 6.8.0 up to and including 6.8.6
From 6.9.0 up to and including 6.9.5
From 7.0.0 up to and including 7.0.2

Fixed in

4.7.34, 4.8.29, 4.9.30, 5.0.26, 5.1.23, 5.2.25, 5.3.22, 5.4.20, 5.5.19, 5.6.18, 5.7.16, 5.8.14, 5.9.14, 6.0.13, 6.1.11, 6.2.10, 6.3.9, 6.4.9, 6.5.9, 6.6.6, 6.7.6, 6.8.7, 6.9.6, 7.0.3

What to do

If your site has an affected version, update WordPress to version 7.0.3 or newer.

Report title

WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass

First reported

8 August 2026

Sources

Wordfence, seen 8 August 2026

This week

A stranger could make your server visit other addresses on their behalf (from 4.7.0 up to and including 4.7.33; from 4.8.0 up to and including 4.8.28; from 4.9.0 up to and including 4.9.29; from 5.0.0 up to and including 5.0.25; from 5.1.0 up to and including 5.1.22; from 5.2.0 up to and including 5.2.24; from 5.3.0 up to and including 5.3.21; from 5.4.0 up to and including 5.4.19; from 5.5.0 up to and including 5.5.18; from 5.6.0 up to and including 5.6.17; from 5.7.0 up to and including 5.7.15; from 5.8.0 up to and including 5.8.13; from 5.9.0 up to and including 5.9.13; from 6.0.0 up to and including 6.0.12; from 6.1.0 up to and including 6.1.10; from 6.2.0 up to and including 6.2.9; from 6.3.0 up to and including 6.3.8; from 6.4.0 up to and including 6.4.8; from 6.5.0 up to and including 6.5.8; from 6.6.0 up to and including 6.6.5; from 6.7.0 up to and including 6.7.5; from 6.8.0 up to and including 6.8.6; from 6.9.0 up to and including 6.9.5; from 7.0.0 up to and including 7.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7.0 up to and including 4.7.33
From 4.8.0 up to and including 4.8.28
From 4.9.0 up to and including 4.9.29
From 5.0.0 up to and including 5.0.25
From 5.1.0 up to and including 5.1.22
From 5.2.0 up to and including 5.2.24
From 5.3.0 up to and including 5.3.21
From 5.4.0 up to and including 5.4.19
From 5.5.0 up to and including 5.5.18
From 5.6.0 up to and including 5.6.17
From 5.7.0 up to and including 5.7.15
From 5.8.0 up to and including 5.8.13
From 5.9.0 up to and including 5.9.13
From 6.0.0 up to and including 6.0.12
From 6.1.0 up to and including 6.1.10
From 6.2.0 up to and including 6.2.9
From 6.3.0 up to and including 6.3.8
From 6.4.0 up to and including 6.4.8
From 6.5.0 up to and including 6.5.8
From 6.6.0 up to and including 6.6.5
From 6.7.0 up to and including 6.7.5
From 6.8.0 up to and including 6.8.6
From 6.9.0 up to and including 6.9.5
From 7.0.0 up to and including 7.0.2

Fixed in

4.7.34, 4.8.29, 4.9.30, 5.0.26, 5.1.23, 5.2.25, 5.3.22, 5.4.20, 5.5.19, 5.6.18, 5.7.16, 5.8.14, 5.9.14, 6.0.13, 6.1.11, 6.2.10, 6.3.9, 6.4.9, 6.5.9, 6.6.6, 6.7.6, 6.8.7, 6.9.6, 7.0.3

What to do

If your site has an affected version, update WordPress to version 7.0.3 or newer.

Report title

WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery

First reported

8 August 2026

Sources

Wordfence, seen 8 August 2026

This week

Someone with an author account on your site could do things on your site they should not be allowed to (from 6.8 up to and including 6.8.3; from 6.9 up to and including 6.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.8 up to and including 6.8.3
From 6.9 up to and including 6.9.1

Fixed in

6.8.4, 6.9.2

What to do

If your site has an affected version, update WordPress to version 6.9.2 or newer.

Report title

WordPress <= 6.9.1 - Missing Authorization to Authenticated (Author+) Sensitive Information Disclosure via query-attachments AJAX Endpoint

First reported

10 March 2026

Sources

Wordfence, seen 10 March 2026

This week

A stranger could make your server visit other addresses on their behalf (from 6.8 up to and including 6.8.3; from 6.9 up to and including 6.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.8 up to and including 6.8.3
From 6.9 up to and including 6.9.1

Fixed in

6.8.4, 6.9.2

What to do

If your site has an affected version, update WordPress to version 6.9.2 or newer.

Report title

WordPress <= 6.9.1 - Unauthenticated Blind Server-Side Request Forgery via XML-RPC Pingback Discovery

First reported

10 March 2026

Sources

Wordfence, seen 10 March 2026

This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins (from 6.8 up to and including 6.8.3; from 6.9 up to and including 6.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.8 up to and including 6.8.3
From 6.9 up to and including 6.9.1

Fixed in

6.8.4, 6.9.2

What to do

If your site has an affected version, update WordPress to version 6.9.2 or newer.

Report title

WordPress <= 6.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Navigation Menu Items

First reported

10 March 2026

Sources

Wordfence, seen 10 March 2026

This week

Someone could plant harmful code that runs for your visitors or admins (from 6.8 up to and including 6.8.3; from 6.9 up to and including 6.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.8 up to and including 6.8.3
From 6.9 up to and including 6.9.1

Fixed in

6.8.4, 6.9.2

What to do

If your site has an affected version, update WordPress to version 6.9.2 or newer.

Report title

WordPress <= 6.9.1 - Cross-Site Scripting via Client-Side Template Override in Admin Area

First reported

10 March 2026

Sources

Wordfence, seen 10 March 2026

This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (from 6.9 up to and including 6.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.9 up to and including 6.9.1

Fixed in

6.9.2

What to do

If your site has an affected version, update WordPress to version 6.9.2 or newer.

Official ID

CVE-2026-3906

Report title

WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API

First reported

10 March 2026

Sources

Wordfence, seen 10 March 2026

This week

Someone with an author account on your site could use it to harm your site (from 6.8 up to and including 6.8.3; from 6.9 up to and including 6.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.8 up to and including 6.8.3
From 6.9 up to and including 6.9.1

Fixed in

6.8.4, 6.9.2

What to do

If your site has an affected version, update WordPress to version 6.9.2 or newer.

Report title

WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload

First reported

10 March 2026

Sources

Wordfence, seen 10 March 2026

This week

Someone with a contributor account on your site could see private information they should not see (from 4.7 up to and including 4.7.30; from 4.8 up to and including 4.8.26; from 4.9 up to and including 4.9.27; from 5.0 up to and including 5.0.23; from 5.1 up to and including 5.1.20; from 5.2 up to and including 5.2.22; from 5.3 up to and including 5.3.19; from 5.4 up to and including 5.4.17; from 5.5 up to and including 5.5.16; from 5.6 up to and including 5.6.15; from 5.7 up to and including 5.7.13; from 5.8 up to and including 5.8.11; from 5.9 up to and including 5.9.11; from 6.0 up to and including 6.0.10; from 6.1 up to and including 6.1.8; from 6.2 up to and including 6.2.7; from 6.3 up to and including 6.3.6; from 6.4 up to and including 6.4.6; from 6.5 up to and including 6.5.6; from 6.6 up to and including 6.6.3; from 6.7 up to and including 6.7.3; from 6.8 up to and including 6.8.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7 up to and including 4.7.30
From 4.8 up to and including 4.8.26
From 4.9 up to and including 4.9.27
From 5.0 up to and including 5.0.23
From 5.1 up to and including 5.1.20
From 5.2 up to and including 5.2.22
From 5.3 up to and including 5.3.19
From 5.4 up to and including 5.4.17
From 5.5 up to and including 5.5.16
From 5.6 up to and including 5.6.15
From 5.7 up to and including 5.7.13
From 5.8 up to and including 5.8.11
From 5.9 up to and including 5.9.11
From 6.0 up to and including 6.0.10
From 6.1 up to and including 6.1.8
From 6.2 up to and including 6.2.7
From 6.3 up to and including 6.3.6
From 6.4 up to and including 6.4.6
From 6.5 up to and including 6.5.6
From 6.6 up to and including 6.6.3
From 6.7 up to and including 6.7.3
From 6.8 up to and including 6.8.2

Fixed in

4.7.31, 4.8.27, 4.9.28, 5.0.24, 5.1.21, 5.2.23, 5.3.20, 5.4.18, 5.5.17, 5.6.16, 5.7.14, 5.8.12, 5.9.12, 6.0.11, 6.1.9, 6.2.8, 6.3.7, 6.4.7, 6.5.7, 6.6.4, 6.7.4, 6.8.3

What to do

If your site has an affected version, update WordPress to version 6.8.3 or newer.

Official ID

CVE-2025-58246

Report title

WordPress <= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure

First reported

22 September 2025

Sources

Wordfence, seen 22 September 2025

This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.7; from 4.7 up to and including 4.7.30; from 4.8 up to and including 4.8.26; from 4.9 up to and including 4.9.27; from 5.0 up to and including 5.0.23; from 5.1 up to and including 5.1.20; from 5.2 up to and including 5.2.22; from 5.3 up to and including 5.3.19; from 5.4 up to and including 5.4.17; from 5.5 up to and including 5.5.16; from 5.6 up to and including 5.6.15; from 5.7 up to and including 5.7.13; from 5.8 up to and including 5.8.11; from 5.9 up to and including 5.9.11; from 6.0 up to and including 6.0.10; from 6.1 up to and including 6.1.8; from 6.2 up to and including 6.2.7; from 6.3 up to and including 6.3.6; from 6.4 up to and including 6.4.6; from 6.5 up to and including 6.5.6; from 6.6 up to and including 6.6.3; from 6.7 up to and including 6.7.3; from 6.8 up to and including 6.8.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 4.7
From 4.7 up to and including 4.7.30
From 4.8 up to and including 4.8.26
From 4.9 up to and including 4.9.27
From 5.0 up to and including 5.0.23
From 5.1 up to and including 5.1.20
From 5.2 up to and including 5.2.22
From 5.3 up to and including 5.3.19
From 5.4 up to and including 5.4.17
From 5.5 up to and including 5.5.16
From 5.6 up to and including 5.6.15
From 5.7 up to and including 5.7.13
From 5.8 up to and including 5.8.11
From 5.9 up to and including 5.9.11
From 6.0 up to and including 6.0.10
From 6.1 up to and including 6.1.8
From 6.2 up to and including 6.2.7
From 6.3 up to and including 6.3.6
From 6.4 up to and including 6.4.6
From 6.5 up to and including 6.5.6
From 6.6 up to and including 6.6.3
From 6.7 up to and including 6.7.3
From 6.8 up to and including 6.8.2

Fixed in

4.7.31, 4.8.27, 4.9.28, 5.0.24, 5.1.21, 5.2.23, 5.3.20, 5.4.18, 5.5.17, 5.6.16, 5.7.14, 5.8.12, 5.9.12, 6.0.11, 6.1.9, 6.2.8, 6.3.7, 6.4.7, 6.5.7, 6.6.4, 6.7.4, 6.8.3

What to do

If your site has an affected version, update WordPress to version 6.8.3 or newer.

Official ID

CVE-2025-58674

Report title

WordPress <= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting

First reported

22 September 2025

Sources

Wordfence, seen 22 September 2025

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 5.9 up to and including 5.9.9; from 6.0 up to and including 6.0.8; from 6.1 up to and including 6.1.6; from 6.2 up to and including 6.2.5; from 6.3 up to and including 6.3.4; from 6.4 up to and including 6.4.4; from 6.5 up to and including 6.5.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.9 up to and including 5.9.9
From 6.0 up to and including 6.0.8
From 6.1 up to and including 6.1.6
From 6.2 up to and including 6.2.5
From 6.3 up to and including 6.3.4
From 6.4 up to and including 6.4.4
From 6.5 up to and including 6.5.4

Fixed in

5.9.10, 6.0.9, 6.1.7, 6.2.6, 6.3.5, 6.4.5, 6.5.5

What to do

If your site has an affected version, update WordPress to version 6.5.5 or newer.

Official ID

CVE-2024-31111

Report title

WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block

First reported

24 June 2024

Sources

Wordfence, seen 24 June 2024

This week

Someone with a contributor account on your site could use it to harm your site (before 4.1; from 4.1 up to and including 4.1.40; from 4.2 up to and including 4.2.37; from 4.3 up to and including 4.3.33; from 4.4 up to and including 4.4.32; from 4.5 up to and including 4.5.31; from 4.6 up to and including 4.6.28; from 4.7 up to and including 4.7.28; from 4.8 up to and including 4.8.24; from 4.9 up to and including 4.9.25; from 5.0 up to and including 5.0.21; from 5.1 up to and including 5.1.18; from 5.2 up to and including 5.2.20; from 5.3 up to and including 5.3.17; from 5.4 up to and including 5.4.15; from 5.5 up to and including 5.5.14; from 5.6 up to and including 5.6.13; from 5.7 up to and including 5.7.11; from 5.8 up to and including 5.8.9; from 5.9 up to and including 5.9.9; from 6.0 up to and including 6.0.8; from 6.1 up to and including 6.1.6; from 6.2 up to and including 6.2.5; from 6.3 up to and including 6.3.4; from 6.4 up to and including 6.4.4; from 6.5 up to and including 6.5.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.1
From 4.1 up to and including 4.1.40
From 4.2 up to and including 4.2.37
From 4.3 up to and including 4.3.33
From 4.4 up to and including 4.4.32
From 4.5 up to and including 4.5.31
From 4.6 up to and including 4.6.28
From 4.7 up to and including 4.7.28
From 4.8 up to and including 4.8.24
From 4.9 up to and including 4.9.25
From 5.0 up to and including 5.0.21
From 5.1 up to and including 5.1.18
From 5.2 up to and including 5.2.20
From 5.3 up to and including 5.3.17
From 5.4 up to and including 5.4.15
From 5.5 up to and including 5.5.14
From 5.6 up to and including 5.6.13
From 5.7 up to and including 5.7.11
From 5.8 up to and including 5.8.9
From 5.9 up to and including 5.9.9
From 6.0 up to and including 6.0.8
From 6.1 up to and including 6.1.6
From 6.2 up to and including 6.2.5
From 6.3 up to and including 6.3.4
From 6.4 up to and including 6.4.4
From 6.5 up to and including 6.5.4

Fixed in

4.1.41, 4.2.38, 4.3.34, 4.4.33, 4.5.32, 4.6.29, 4.7.29, 4.8.25, 4.9.26, 5.0.22, 5.1.19, 5.2.21, 5.3.18, 5.4.16, 5.5.15, 5.6.14, 5.7.12, 5.8.10, 5.9.10, 6.0.9, 6.1.7, 6.2.6, 6.3.5, 6.4.5, 6.5.5

What to do

If your site has an affected version, update WordPress to version 6.5.5 or newer.

Official ID

CVE-2024-32111

Report title

WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal

First reported

24 June 2024

Sources

Wordfence, seen 24 June 2024

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 5.9 up to and including 5.9.9; from 6.0 up to and including 6.0.8; from 6.1 up to and including 6.1.6; from 6.2 up to and including 6.2.5; from 6.3 up to and including 6.3.4; from 6.4 up to and including 6.4.4; from 6.5 up to and including 6.5.4) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.9 up to and including 5.9.9
From 6.0 up to and including 6.0.8
From 6.1 up to and including 6.1.6
From 6.2 up to and including 6.2.5
From 6.3 up to and including 6.3.4
From 6.4 up to and including 6.4.4
From 6.5 up to and including 6.5.4

Fixed in

5.9.10, 6.0.9, 6.1.7, 6.2.6, 6.3.5, 6.4.5, 6.5.5

What to do

If your site has an affected version, update WordPress to version 6.5.5 or newer.

Official ID

CVE-2024-6307

Report title

WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API

First reported

24 June 2024

Sources

Wordfence, seen 24 June 2024

This week

A stranger could plant harmful code that runs for your visitors or admins (from 6.0 up to and including 6.0.7; from 6.1 up to and including 6.1.5; from 6.2 up to and including 6.2.4; from 6.3 up to and including 6.3.3; from 6.4 up to and including 6.4.3; from 6.5 up to and including 6.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.0 up to and including 6.0.7
From 6.1 up to and including 6.1.5
From 6.2 up to and including 6.2.4
From 6.3 up to and including 6.3.3
From 6.4 up to and including 6.4.3
From 6.5 up to and including 6.5.1

Fixed in

6.0.8, 6.1.6, 6.2.5, 6.3.4, 6.4.4, 6.5.2

What to do

If your site has an affected version, update WordPress to version 6.5.2 or newer.

Official ID

CVE-2024-4439

Report title

WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block

First reported

9 April 2024

Sources

Wordfence, seen 9 April 2024

This week

Someone could see private information they should not see (up to and including 6.4.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 6.4.3

Fixed in

6.5

What to do

If your site has an affected version, update WordPress to version 6.5 or newer.

Official ID

CVE-2023-5692

Report title

WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink

First reported

4 April 2024

Sources

Wordfence, seen 4 April 2024

This week

Someone could run their own code on your site and take it over (from 6.4.0 up to and including 6.4.0; from 6.4.1 up to and including 6.4.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.4.0 up to and including 6.4.0
From 6.4.1 up to and including 6.4.1

Fixed in

6.4.2

What to do

If your site has an affected version, update WordPress to version 6.4.2 or newer.

Official ID

CVE-2024-31211

Report title

WordPress Core 6.4.0 - 6.4.1 - Remote Code Execution POP Chain

First reported

6 December 2023

Sources

Wordfence, seen 6 December 2023

This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 4.1.38; from 4.2 up to and including 4.2.35; from 4.3 up to and including 4.3.31; from 4.4 up to and including 4.4.30; from 4.5 up to and including 4.5.29; from 4.6 up to and including 4.6.26; from 4.7 up to and including 4.7.26; from 4.8 up to and including 4.8.22; from 4.9 up to and including 4.9.23; from 5.0 up to and including 5.0.19; from 5.1 up to and including 5.1.16; from 5.2 up to and including 5.2.18; from 5.3 up to and including 5.3.15; from 5.4 up to and including 5.4.13; from 5.5 up to and including 5.5.12; from 5.6 up to and including 5.6.11; from 5.7 up to and including 5.7.9; from 5.8 up to and including 5.8.7; from 5.9 up to and including 5.9.7; from 6.0 up to and including 6.0.5; from 6.1 up to and including 6.1.3; from 6.2 up to and including 6.2.2; from 6.3 up to and including 6.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 4.1.38
From 4.2 up to and including 4.2.35
From 4.3 up to and including 4.3.31
From 4.4 up to and including 4.4.30
From 4.5 up to and including 4.5.29
From 4.6 up to and including 4.6.26
From 4.7 up to and including 4.7.26
From 4.8 up to and including 4.8.22
From 4.9 up to and including 4.9.23
From 5.0 up to and including 5.0.19
From 5.1 up to and including 5.1.16
From 5.2 up to and including 5.2.18
From 5.3 up to and including 5.3.15
From 5.4 up to and including 5.4.13
From 5.5 up to and including 5.5.12
From 5.6 up to and including 5.6.11
From 5.7 up to and including 5.7.9
From 5.8 up to and including 5.8.7
From 5.9 up to and including 5.9.7
From 6.0 up to and including 6.0.5
From 6.1 up to and including 6.1.3
From 6.2 up to and including 6.2.2
From 6.3 up to and including 6.3.1

Fixed in

4.1.39, 4.2.36, 4.3.32, 4.4.31, 4.5.30, 4.6.27, 4.7.27, 4.8.23, 4.9.24, 5.0.20, 5.1.17, 5.2.19, 5.3.16, 5.4.14, 5.5.13, 5.6.12, 5.7.10, 5.8.8, 5.9.8, 6.0.6, 6.1.4, 6.2.3, 6.3.2

What to do

If your site has an affected version, update WordPress to version 6.3.2 or newer.

Report title

WordPress Core < 6.3.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via parse-media-shortcode

First reported

12 October 2023

Sources

Wordfence, seen 12 October 2023

This week

Someone could see private information they should not see (from 4.7 up to and including 4.7.26; from 4.8 up to and including 4.8.22; from 4.9 up to and including 4.9.23; from 5.0 up to and including 5.0.19; from 5.1 up to and including 5.1.16; from 5.2 up to and including 5.2.18; from 5.3 up to and including 5.3.15; from 5.4 up to and including 5.4.13; from 5.5 up to and including 5.5.12; from 5.6 up to and including 5.6.11; from 5.7 up to and including 5.7.9; from 5.8 up to and including 5.8.7; from 5.9 up to and including 5.9.7; from 6.0 up to and including 6.0.5; from 6.1 up to and including 6.1.3; from 6.2 up to and including 6.2.2; from 6.3 up to and including 6.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7 up to and including 4.7.26
From 4.8 up to and including 4.8.22
From 4.9 up to and including 4.9.23
From 5.0 up to and including 5.0.19
From 5.1 up to and including 5.1.16
From 5.2 up to and including 5.2.18
From 5.3 up to and including 5.3.15
From 5.4 up to and including 5.4.13
From 5.5 up to and including 5.5.12
From 5.6 up to and including 5.6.11
From 5.7 up to and including 5.7.9
From 5.8 up to and including 5.8.7
From 5.9 up to and including 5.9.7
From 6.0 up to and including 6.0.5
From 6.1 up to and including 6.1.3
From 6.2 up to and including 6.2.2
From 6.3 up to and including 6.3.1

Fixed in

4.7.27, 4.8.23, 4.9.24, 5.0.20, 5.1.17, 5.2.19, 5.3.16, 5.4.14, 5.5.13, 5.6.12, 5.7.10, 5.8.8, 5.9.8, 6.0.6, 6.1.4, 6.2.3, 6.3.2

What to do

If your site has an affected version, update WordPress to version 6.3.2 or newer.

Official ID

CVE-2023-5561

Report title

WordPress Core 4.7.0 - 6.3.1 - Sensitive Information Exposure via User Search REST Endpoint

First reported

12 October 2023

Sources

Wordfence, seen 12 October 2023

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 5.9 up to and including 5.9.7; from 6.0 up to and including 6.0.5; from 6.1 up to and including 6.1.3; from 6.2 up to and including 6.2.2; from 6.3 up to and including 6.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.9 up to and including 5.9.7
From 6.0 up to and including 6.0.5
From 6.1 up to and including 6.1.3
From 6.2 up to and including 6.2.2
From 6.3 up to and including 6.3.1

Fixed in

5.9.8, 6.0.6, 6.1.4, 6.2.3, 6.3.2

What to do

If your site has an affected version, update WordPress to version 6.3.2 or newer.

Official ID

CVE-2023-38000

Report title

WordPress Core 5.9-6.3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes

First reported

12 October 2023

Sources

Wordfence, seen 12 October 2023

This week

Someone with a contributor account on your site could see private information they should not see (up to and including 4.1.38; from 4.2 up to and including 4.2.35; from 4.3 up to and including 4.3.31; from 4.4 up to and including 4.4.30; from 4.5 up to and including 4.5.29; from 4.6 up to and including 4.6.26; from 4.7 up to and including 4.7.26; from 4.8 up to and including 4.8.22; from 4.9 up to and including 4.9.23; from 5.0 up to and including 5.0.19; from 5.1 up to and including 5.1.16; from 5.2 up to and including 5.2.18; from 5.3 up to and including 5.3.15; from 5.4 up to and including 5.4.13; from 5.5 up to and including 5.5.12; from 5.6 up to and including 5.6.11; from 5.7 up to and including 5.7.9; from 5.8 up to and including 5.8.7; from 5.9 up to and including 5.9.7; from 6.0 up to and including 6.0.5; from 6.1 up to and including 6.1.3; from 6.2 up to and including 6.2.2; from 6.3 up to and including 6.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 4.1.38
From 4.2 up to and including 4.2.35
From 4.3 up to and including 4.3.31
From 4.4 up to and including 4.4.30
From 4.5 up to and including 4.5.29
From 4.6 up to and including 4.6.26
From 4.7 up to and including 4.7.26
From 4.8 up to and including 4.8.22
From 4.9 up to and including 4.9.23
From 5.0 up to and including 5.0.19
From 5.1 up to and including 5.1.16
From 5.2 up to and including 5.2.18
From 5.3 up to and including 5.3.15
From 5.4 up to and including 5.4.13
From 5.5 up to and including 5.5.12
From 5.6 up to and including 5.6.11
From 5.7 up to and including 5.7.9
From 5.8 up to and including 5.8.7
From 5.9 up to and including 5.9.7
From 6.0 up to and including 6.0.5
From 6.1 up to and including 6.1.3
From 6.2 up to and including 6.2.2
From 6.3 up to and including 6.3.1

Fixed in

4.1.39, 4.2.36, 4.3.32, 4.4.31, 4.5.30, 4.6.27, 4.7.27, 4.8.23, 4.9.24, 5.0.20, 5.1.17, 5.2.19, 5.3.16, 5.4.14, 5.5.13, 5.6.12, 5.7.10, 5.8.8, 5.9.8, 6.0.6, 6.1.4, 6.2.3, 6.3.2

What to do

If your site has an affected version, update WordPress to version 6.3.2 or newer.

Official ID

CVE-2023-39999

Report title

WordPress Core <= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts

First reported

12 October 2023

Sources

Wordfence, seen 12 October 2023

This week

Someone could plant harmful code that runs for your visitors or admins (from 5.6 up to and including 5.6.11; from 5.7 up to and including 5.7.9; from 5.8 up to and including 5.8.7; from 5.9 up to and including 5.9.7; from 6.0 up to and including 6.0.5; from 6.1 up to and including 6.1.3; from 6.2 up to and including 6.2.2; from 6.3 up to and including 6.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.6 up to and including 5.6.11
From 5.7 up to and including 5.7.9
From 5.8 up to and including 5.8.7
From 5.9 up to and including 5.9.7
From 6.0 up to and including 6.0.5
From 6.1 up to and including 6.1.3
From 6.2 up to and including 6.2.2
From 6.3 up to and including 6.3.1

Fixed in

5.6.12, 5.7.10, 5.8.8, 5.9.8, 6.0.6, 6.1.4, 6.2.3, 6.3.2

What to do

If your site has an affected version, update WordPress to version 6.3.2 or newer.

Report title

WordPress Core 5.6 - 6.3.1 - Reflected Cross-Site Scripting via Application Password Requests

First reported

12 October 2023

Sources

Wordfence, seen 12 October 2023

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 6.3 up to and including 6.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 6.3 up to and including 6.3.1

Fixed in

6.3.2

What to do

If your site has an affected version, update WordPress to version 6.3.2 or newer.

Report title

WordPress Core 6.3 - 6.3.1 - Authenticated(Contributor+) Cross-Site Scripting via Footnotes Block

First reported

12 October 2023

Sources

Wordfence, seen 12 October 2023

This week

Someone could slow down or crash your site (from 4.7 up to and including 4.7.26; from 4.8 up to and including 4.8.22; from 4.9 up to and including 4.9.23; from 5.0 up to and including 5.0.19; from 5.1 up to and including 5.1.16; from 5.2 up to and including 5.2.18; from 5.3 up to and including 5.3.15; from 5.4 up to and including 5.4.13; from 5.5 up to and including 5.5.12; from 5.6 up to and including 5.6.11; from 5.7 up to and including 5.7.9; from 5.8 up to and including 5.8.7; from 5.9 up to and including 5.9.7; from 6.0 up to and including 6.0.5; from 6.1 up to and including 6.1.3; from 6.2 up to and including 6.2.2; from 6.3 up to and including 6.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7 up to and including 4.7.26
From 4.8 up to and including 4.8.22
From 4.9 up to and including 4.9.23
From 5.0 up to and including 5.0.19
From 5.1 up to and including 5.1.16
From 5.2 up to and including 5.2.18
From 5.3 up to and including 5.3.15
From 5.4 up to and including 5.4.13
From 5.5 up to and including 5.5.12
From 5.6 up to and including 5.6.11
From 5.7 up to and including 5.7.9
From 5.8 up to and including 5.8.7
From 5.9 up to and including 5.9.7
From 6.0 up to and including 6.0.5
From 6.1 up to and including 6.1.3
From 6.2 up to and including 6.2.2
From 6.3 up to and including 6.3.1

Fixed in

4.7.27, 4.8.23, 4.9.24, 5.0.20, 5.1.17, 5.2.19, 5.3.16, 5.4.14, 5.5.13, 5.6.12, 5.7.10, 5.8.8, 5.9.8, 6.0.6, 6.1.4, 6.2.3, 6.3.2

What to do

If your site has an affected version, update WordPress to version 6.3.2 or newer.

Report title

WordPress Core 4.7.0-6.3.1 - Denial of Service via Cache Poisoning

First reported

12 October 2023

Sources

Wordfence, seen 12 October 2023

This week

Someone could use it to harm your site (from 5.9 up to, but not including, 5.9.7; from 6.0 up to, but not including, 6.0.5; from 6.1 up to, but not including, 6.1.3; from 6.2 up to, but not including, 6.2.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.9 up to, but not including, 5.9.7
From 6.0 up to, but not including, 6.0.5
From 6.1 up to, but not including, 6.1.3
From 6.2 up to, but not including, 6.2.2

Fixed in

5.9.7, 6.0.5, 6.1.3, 6.2.2

What to do

If your site has an affected version, update WordPress to version 6.2.2 or newer.

Report title

WordPress Core < 6.2.2 - Shortcode Execution in User Generated Content

First reported

19 May 2023

Sources

Wordfence, seen 19 May 2023

This week

Someone could use it to harm your site (from 5.9 up to, but not including, 5.9.6; from 6.0 up to, but not including, 6.0.4; from 6.1 up to, but not including, 6.1.2; from 6.2 up to, but not including, 6.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.9 up to, but not including, 5.9.6
From 6.0 up to, but not including, 6.0.4
From 6.1 up to, but not including, 6.1.2
From 6.2 up to, but not including, 6.2.1

Fixed in

5.9.6, 6.0.4, 6.1.2, 6.2.1

What to do

If your site has an affected version, update WordPress to version 6.2.1 or newer.

Report title

WordPress Core < 6.2.1 - Shortcode Execution in User Generated Content

First reported

19 May 2023

Sources

Wordfence, seen 19 May 2023

This week

Someone could trick a logged-in admin into changing settings without knowing (before 4.1; from 4.1 up to, but not including, 4.1.38; from 4.2 up to, but not including, 4.2.35; from 4.3 up to, but not including, 4.3.31; from 4.4 up to, but not including, 4.4.30; from 4.5 up to, but not including, 4.5.29; from 4.6 up to, but not including, 4.6.26; from 4.7 up to, but not including, 4.7.26; from 4.8 up to, but not including, 4.8.22; from 4.9 up to, but not including, 4.9.23; from 5.0 up to, but not including, 5.0.19; from 5.1 up to, but not including, 5.1.16; from 5.2 up to, but not including, 5.2.18; from 5.3 up to, but not including, 5.3.15; from 5.4 up to, but not including, 5.4.13; from 5.5 up to, but not including, 5.5.12; from 5.6 up to, but not including, 5.6.11; from 5.7 up to, but not including, 5.7.9; from 5.8 up to, but not including, 5.8.7; from 5.9 up to, but not including, 5.9.6; from 6.0 up to, but not including, 6.0.4; from 6.1 up to, but not including, 6.1.2; from 6.2 up to, but not including, 6.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.1
From 4.1 up to, but not including, 4.1.38
From 4.2 up to, but not including, 4.2.35
From 4.3 up to, but not including, 4.3.31
From 4.4 up to, but not including, 4.4.30
From 4.5 up to, but not including, 4.5.29
From 4.6 up to, but not including, 4.6.26
From 4.7 up to, but not including, 4.7.26
From 4.8 up to, but not including, 4.8.22
From 4.9 up to, but not including, 4.9.23
From 5.0 up to, but not including, 5.0.19
From 5.1 up to, but not including, 5.1.16
From 5.2 up to, but not including, 5.2.18
From 5.3 up to, but not including, 5.3.15
From 5.4 up to, but not including, 5.4.13
From 5.5 up to, but not including, 5.5.12
From 5.6 up to, but not including, 5.6.11
From 5.7 up to, but not including, 5.7.9
From 5.8 up to, but not including, 5.8.7
From 5.9 up to, but not including, 5.9.6
From 6.0 up to, but not including, 6.0.4
From 6.1 up to, but not including, 6.1.2
From 6.2 up to, but not including, 6.2.1

Fixed in

4.1.38, 4.2.35, 4.3.31, 4.4.30, 4.5.29, 4.6.26, 4.7.26, 4.8.22, 4.9.23, 5.0.19, 5.1.16, 5.2.18, 5.3.15, 5.4.13, 5.5.12, 5.6.11, 5.7.9, 5.8.7, 5.9.6, 6.0.4, 6.1.2, 6.2.1

What to do

If your site has an affected version, update WordPress to version 6.2.1 or newer.

Report title

WordPress Core < 6.2.1 - Cross-Site Request Forgery

First reported

16 May 2023

Sources

Wordfence, seen 16 May 2023

This week

Someone could use it to harm your site (before 4.1; from 4.1 up to, but not including, 4.1.38; from 4.2 up to, but not including, 4.2.35; from 4.3 up to, but not including, 4.3.31; from 4.4 up to, but not including, 4.4.30; from 4.5 up to, but not including, 4.5.29; from 4.6 up to, but not including, 4.6.26; from 4.7 up to, but not including, 4.7.26; from 4.8 up to, but not including, 4.8.22; from 4.9 up to, but not including, 4.9.23; from 5.0 up to, but not including, 5.0.19; from 5.1 up to, but not including, 5.1.16; from 5.2 up to, but not including, 5.2.18; from 5.3 up to, but not including, 5.3.15; from 5.4 up to, but not including, 5.4.13; from 5.5 up to, but not including, 5.5.12; from 5.6 up to, but not including, 5.6.11; from 5.7 up to, but not including, 5.7.9; from 5.8 up to, but not including, 5.8.7; from 5.9 up to, but not including, 5.9.6; from 6.0 up to, but not including, 6.0.4; from 6.1 up to, but not including, 6.1.2; from 6.2 up to, but not including, 6.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.1
From 4.1 up to, but not including, 4.1.38
From 4.2 up to, but not including, 4.2.35
From 4.3 up to, but not including, 4.3.31
From 4.4 up to, but not including, 4.4.30
From 4.5 up to, but not including, 4.5.29
From 4.6 up to, but not including, 4.6.26
From 4.7 up to, but not including, 4.7.26
From 4.8 up to, but not including, 4.8.22
From 4.9 up to, but not including, 4.9.23
From 5.0 up to, but not including, 5.0.19
From 5.1 up to, but not including, 5.1.16
From 5.2 up to, but not including, 5.2.18
From 5.3 up to, but not including, 5.3.15
From 5.4 up to, but not including, 5.4.13
From 5.5 up to, but not including, 5.5.12
From 5.6 up to, but not including, 5.6.11
From 5.7 up to, but not including, 5.7.9
From 5.8 up to, but not including, 5.8.7
From 5.9 up to, but not including, 5.9.6
From 6.0 up to, but not including, 6.0.4
From 6.1 up to, but not including, 6.1.2
From 6.2 up to, but not including, 6.2.1

Fixed in

4.1.38, 4.2.35, 4.3.31, 4.4.30, 4.5.29, 4.6.26, 4.7.26, 4.8.22, 4.9.23, 5.0.19, 5.1.16, 5.2.18, 5.3.15, 5.4.13, 5.5.12, 5.6.11, 5.7.9, 5.8.7, 5.9.6, 6.0.4, 6.1.2, 6.2.1

What to do

If your site has an affected version, update WordPress to version 6.2.1 or newer.

Report title

WordPress Core < 6.2.1 - Insufficient Sanitization of Block Attributes

First reported

16 May 2023

Sources

Wordfence, seen 16 May 2023

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (before 4.1.38; from 4.2 up to, but not including, 4.2.35; from 4.3 up to, but not including, 4.3.31; from 4.4 up to, but not including, 4.4.30; from 4.5 up to, but not including, 4.5.29; from 4.6 up to, but not including, 4.6.26; from 4.7 up to, but not including, 4.7.26; from 4.8 up to, but not including, 4.8.22; from 4.9 up to, but not including, 4.9.23; from 5.0 up to, but not including, 5.0.19; from 5.1 up to, but not including, 5.1.16; from 5.2 up to, but not including, 5.2.18; from 5.3 up to, but not including, 5.3.15; from 5.4 up to, but not including, 5.4.13; from 5.5 up to, but not including, 5.5.12; from 5.6 up to, but not including, 5.6.11; from 5.7 up to, but not including, 5.7.9; from 5.8 up to, but not including, 5.8.7; from 5.9 up to, but not including, 5.9.6; from 6.0 up to, but not including, 6.0.4; from 6.1 up to, but not including, 6.1.2; from 6.2 up to, but not including, 6.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.1.38
From 4.2 up to, but not including, 4.2.35
From 4.3 up to, but not including, 4.3.31
From 4.4 up to, but not including, 4.4.30
From 4.5 up to, but not including, 4.5.29
From 4.6 up to, but not including, 4.6.26
From 4.7 up to, but not including, 4.7.26
From 4.8 up to, but not including, 4.8.22
From 4.9 up to, but not including, 4.9.23
From 5.0 up to, but not including, 5.0.19
From 5.1 up to, but not including, 5.1.16
From 5.2 up to, but not including, 5.2.18
From 5.3 up to, but not including, 5.3.15
From 5.4 up to, but not including, 5.4.13
From 5.5 up to, but not including, 5.5.12
From 5.6 up to, but not including, 5.6.11
From 5.7 up to, but not including, 5.7.9
From 5.8 up to, but not including, 5.8.7
From 5.9 up to, but not including, 5.9.6
From 6.0 up to, but not including, 6.0.4
From 6.1 up to, but not including, 6.1.2
From 6.2 up to, but not including, 6.2.1

Fixed in

4.1.38, 4.2.35, 4.3.31, 4.4.30, 4.5.29, 4.6.26, 4.7.26, 4.8.22, 4.9.23, 5.0.19, 5.1.16, 5.2.18, 5.3.15, 5.4.13, 5.5.12, 5.6.11, 5.7.9, 5.8.7, 5.9.6, 6.0.4, 6.1.2, 6.2.1

What to do

If your site has an affected version, update WordPress to version 6.2.1 or newer.

Report title

WordPress Core < 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Embed Discovery

First reported

16 May 2023

Sources

Wordfence, seen 16 May 2023

This week

Someone could use it to harm your site (before 4.1.38; from 4.2 up to, but not including, 4.2.35; from 4.3 up to, but not including, 4.3.31; from 4.4 up to, but not including, 4.4.30; from 4.5 up to, but not including, 4.5.29; from 4.6 up to, but not including, 4.6.26; from 4.7 up to, but not including, 4.7.26; from 4.8 up to, but not including, 4.8.22; from 4.9 up to, but not including, 4.9.23; from 5.0 up to, but not including, 5.0.19; from 5.1 up to, but not including, 5.1.16; from 5.2 up to, but not including, 5.2.18; from 5.3 up to, but not including, 5.3.15; from 5.4 up to, but not including, 5.4.13; from 5.5 up to, but not including, 5.5.12; from 5.6 up to, but not including, 5.6.11; from 5.7 up to, but not including, 5.7.9; from 5.8 up to, but not including, 5.8.7; from 5.9 up to, but not including, 5.9.6; from 6.0 up to, but not including, 6.0.4; from 6.1 up to, but not including, 6.1.2; from 6.2 up to, but not including, 6.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.1.38
From 4.2 up to, but not including, 4.2.35
From 4.3 up to, but not including, 4.3.31
From 4.4 up to, but not including, 4.4.30
From 4.5 up to, but not including, 4.5.29
From 4.6 up to, but not including, 4.6.26
From 4.7 up to, but not including, 4.7.26
From 4.8 up to, but not including, 4.8.22
From 4.9 up to, but not including, 4.9.23
From 5.0 up to, but not including, 5.0.19
From 5.1 up to, but not including, 5.1.16
From 5.2 up to, but not including, 5.2.18
From 5.3 up to, but not including, 5.3.15
From 5.4 up to, but not including, 5.4.13
From 5.5 up to, but not including, 5.5.12
From 5.6 up to, but not including, 5.6.11
From 5.7 up to, but not including, 5.7.9
From 5.8 up to, but not including, 5.8.7
From 5.9 up to, but not including, 5.9.6
From 6.0 up to, but not including, 6.0.4
From 6.1 up to, but not including, 6.1.2
From 6.2 up to, but not including, 6.2.1

Fixed in

4.1.38, 4.2.35, 4.3.31, 4.4.30, 4.5.29, 4.6.26, 4.7.26, 4.8.22, 4.9.23, 5.0.19, 5.1.16, 5.2.18, 5.3.15, 5.4.13, 5.5.12, 5.6.11, 5.7.9, 5.8.7, 5.9.6, 6.0.4, 6.1.2, 6.2.1

What to do

If your site has an affected version, update WordPress to version 6.2.1 or newer.

Official ID

CVE-2023-2745

Report title

WordPress Core < 6.2.1 - Directory Traversal

First reported

16 May 2023

Sources

Wordfence, seen 16 May 2023

This week

Someone could use it to harm your site (up to and including 3.6.1; from 3.7 up to and including 3.7.39; from 3.8 up to and including 3.8.39; from 3.9 up to and including 3.9.37; from 4.0 up to and including 4.0.36; from 4.1 up to and including 4.1.36; from 4.2 up to and including 4.2.33; from 4.3 up to and including 4.3.29; from 4.4 up to and including 4.4.28; from 4.5 up to and including 4.5.27; from 4.6 up to and including 4.6.24; from 4.7 up to and including 4.7.24; from 4.8 up to and including 4.8.20; from 4.9 up to and including 4.9.21; from 5.0 up to and including 5.0.17; from 5.1 up to and including 5.1.14; from 5.2 up to and including 5.2.16; from 5.3 up to and including 5.3.13; from 5.4 up to and including 5.4.11; from 5.5 up to and including 5.5.10; from 5.6 up to and including 5.6.9; from 5.7 up to and including 5.7.7; from 5.8 up to and including 5.8.5; from 5.9 up to and including 5.9.4; from 6.0 up to and including 6.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.39
From 3.8 up to and including 3.8.39
From 3.9 up to and including 3.9.37
From 4.0 up to and including 4.0.36
From 4.1 up to and including 4.1.36
From 4.2 up to and including 4.2.33
From 4.3 up to and including 4.3.29
From 4.4 up to and including 4.4.28
From 4.5 up to and including 4.5.27
From 4.6 up to and including 4.6.24
From 4.7 up to and including 4.7.24
From 4.8 up to and including 4.8.20
From 4.9 up to and including 4.9.21
From 5.0 up to and including 5.0.17
From 5.1 up to and including 5.1.14
From 5.2 up to and including 5.2.16
From 5.3 up to and including 5.3.13
From 5.4 up to and including 5.4.11
From 5.5 up to and including 5.5.10
From 5.6 up to and including 5.6.9
From 5.7 up to and including 5.7.7
From 5.8 up to and including 5.8.5
From 5.9 up to and including 5.9.4
From 6.0 up to and including 6.0.2

Fixed in

3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3

What to do

If your site has an affected version, update WordPress to version 6.0.3 or newer.

Report title

WordPress Core < 6.0.3 - Shared User Instance Weakness

First reported

18 October 2022

Sources

Wordfence, seen 18 October 2022

This week

Someone could send your visitors from your site to a harmful site (up to and including 3.6.1; from 3.7 up to and including 3.7.39; from 3.8 up to and including 3.8.39; from 3.9 up to and including 3.9.37; from 4.0 up to and including 4.0.36; from 4.1 up to and including 4.1.36; from 4.2 up to and including 4.2.33; from 4.3 up to and including 4.3.29; from 4.4 up to and including 4.4.28; from 4.5 up to and including 4.5.27; from 4.6 up to and including 4.6.24; from 4.7 up to and including 4.7.24; from 4.8 up to and including 4.8.20; from 4.9 up to and including 4.9.21; from 5.0 up to and including 5.0.17; from 5.1 up to and including 5.1.14; from 5.2 up to and including 5.2.16; from 5.3 up to and including 5.3.13; from 5.4 up to and including 5.4.11; from 5.5 up to and including 5.5.10; from 5.6 up to and including 5.6.9; from 5.7 up to and including 5.7.7; from 5.8 up to and including 5.8.5; from 5.9 up to and including 5.9.4; from 6.0 up to and including 6.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.39
From 3.8 up to and including 3.8.39
From 3.9 up to and including 3.9.37
From 4.0 up to and including 4.0.36
From 4.1 up to and including 4.1.36
From 4.2 up to and including 4.2.33
From 4.3 up to and including 4.3.29
From 4.4 up to and including 4.4.28
From 4.5 up to and including 4.5.27
From 4.6 up to and including 4.6.24
From 4.7 up to and including 4.7.24
From 4.8 up to and including 4.8.20
From 4.9 up to and including 4.9.21
From 5.0 up to and including 5.0.17
From 5.1 up to and including 5.1.14
From 5.2 up to and including 5.2.16
From 5.3 up to and including 5.3.13
From 5.4 up to and including 5.4.11
From 5.5 up to and including 5.5.10
From 5.6 up to and including 5.6.9
From 5.7 up to and including 5.7.7
From 5.8 up to and including 5.8.5
From 5.9 up to and including 5.9.4
From 6.0 up to and including 6.0.2

Fixed in

3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3

What to do

If your site has an affected version, update WordPress to version 6.0.3 or newer.

Report title

WordPress Core < 6.0.3 - Open Redirect

First reported

18 October 2022

Sources

Wordfence, seen 18 October 2022

This week

Someone could use it to harm your site (up to and including 3.6.1; from 3.7 up to and including 3.7.39; from 3.8 up to and including 3.8.39; from 3.9 up to and including 3.9.37; from 4.0 up to and including 4.0.36; from 4.1 up to and including 4.1.36; from 4.2 up to and including 4.2.33; from 4.3 up to and including 4.3.29; from 4.4 up to and including 4.4.28; from 4.5 up to and including 4.5.27; from 4.6 up to and including 4.6.24; from 4.7 up to and including 4.7.24; from 4.8 up to and including 4.8.20; from 4.9 up to and including 4.9.21; from 5.0 up to and including 5.0.17; from 5.1 up to and including 5.1.14; from 5.2 up to and including 5.2.16; from 5.3 up to and including 5.3.13; from 5.4 up to and including 5.4.11; from 5.5 up to and including 5.5.10; from 5.6 up to and including 5.6.9; from 5.7 up to and including 5.7.7; from 5.8 up to and including 5.8.5; from 5.9 up to and including 5.9.4; from 6.0 up to and including 6.0.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.39
From 3.8 up to and including 3.8.39
From 3.9 up to and including 3.9.37
From 4.0 up to and including 4.0.36
From 4.1 up to and including 4.1.36
From 4.2 up to and including 4.2.33
From 4.3 up to and including 4.3.29
From 4.4 up to and including 4.4.28
From 4.5 up to and including 4.5.27
From 4.6 up to and including 4.6.24
From 4.7 up to and including 4.7.24
From 4.8 up to and including 4.8.20
From 4.9 up to and including 4.9.21
From 5.0 up to and including 5.0.17
From 5.1 up to and including 5.1.14
From 5.2 up to and including 5.2.16
From 5.3 up to and including 5.3.13
From 5.4 up to and including 5.4.11
From 5.5 up to and including 5.5.10
From 5.6 up to and including 5.6.9
From 5.7 up to and including 5.7.7
From 5.8 up to and including 5.8.5
From 5.9 up to and including 5.9.4
From 6.0 up to and including 6.0.2

Fixed in

3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3

What to do

If your site has an affected version, update WordPress to version 6.0.3 or newer.

Report title

WordPress Core < 6.0.3 - Information Disclosure (Multi-Part Email Leak)

First reported

18 October 2022

Sources

Wordfence, seen 18 October 2022

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.6.1; from 3.7 up to and including 3.7.39; from 3.8 up to and including 3.8.39; from 3.9 up to and including 3.9.37; from 4.0 up to and including 4.0.36; from 4.1 up to and including 4.1.36; from 4.2 up to and including 4.2.33; from 4.3 up to and including 4.3.29; from 4.4 up to and including 4.4.28; from 4.5 up to and including 4.5.27; from 4.6 up to and including 4.6.24; from 4.7 up to and including 4.7.24; from 4.8 up to and including 4.8.20; from 4.9 up to and including 4.9.21; from 5.0 up to and including 5.0.17; from 5.1 up to and including 5.1.14; from 5.2 up to and including 5.2.16; from 5.3 up to and including 5.3.13; from 5.4 up to and including 5.4.11; from 5.5 up to and including 5.5.10; from 5.6 up to and including 5.6.9; from 5.7 up to and including 5.7.7; from 5.8 up to and including 5.8.5; from 5.9 up to and including 5.9.4; from 6.0 up to and including 6.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.39
From 3.8 up to and including 3.8.39
From 3.9 up to and including 3.9.37
From 4.0 up to and including 4.0.36
From 4.1 up to and including 4.1.36
From 4.2 up to and including 4.2.33
From 4.3 up to and including 4.3.29
From 4.4 up to and including 4.4.28
From 4.5 up to and including 4.5.27
From 4.6 up to and including 4.6.24
From 4.7 up to and including 4.7.24
From 4.8 up to and including 4.8.20
From 4.9 up to and including 4.9.21
From 5.0 up to and including 5.0.17
From 5.1 up to and including 5.1.14
From 5.2 up to and including 5.2.16
From 5.3 up to and including 5.3.13
From 5.4 up to and including 5.4.11
From 5.5 up to and including 5.5.10
From 5.6 up to and including 5.6.9
From 5.7 up to and including 5.7.7
From 5.8 up to and including 5.8.5
From 5.9 up to and including 5.9.4
From 6.0 up to and including 6.0.2

Fixed in

3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3

What to do

If your site has an affected version, update WordPress to version 6.0.3 or newer.

Report title

WordPress Core < 6.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Customizer

First reported

18 October 2022

Sources

Wordfence, seen 18 October 2022

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.6.1; from 3.7 up to and including 3.7.39; from 3.8 up to and including 3.8.39; from 3.9 up to and including 3.9.37; from 4.0 up to and including 4.0.36; from 4.1 up to and including 4.1.36; from 4.2 up to and including 4.2.33; from 4.3 up to and including 4.3.29; from 4.4 up to and including 4.4.28; from 4.5 up to and including 4.5.27; from 4.6 up to and including 4.6.24; from 4.7 up to and including 4.7.24; from 4.8 up to and including 4.8.20; from 4.9 up to and including 4.9.21; from 5.0 up to and including 5.0.17; from 5.1 up to and including 5.1.14; from 5.2 up to and including 5.2.16; from 5.3 up to and including 5.3.13; from 5.4 up to and including 5.4.11; from 5.5 up to and including 5.5.10; from 5.6 up to and including 5.6.9; from 5.7 up to and including 5.7.7; from 5.8 up to and including 5.8.5; from 5.9 up to and including 5.9.4; from 6.0 up to and including 6.0.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.39
From 3.8 up to and including 3.8.39
From 3.9 up to and including 3.9.37
From 4.0 up to and including 4.0.36
From 4.1 up to and including 4.1.36
From 4.2 up to and including 4.2.33
From 4.3 up to and including 4.3.29
From 4.4 up to and including 4.4.28
From 4.5 up to and including 4.5.27
From 4.6 up to and including 4.6.24
From 4.7 up to and including 4.7.24
From 4.8 up to and including 4.8.20
From 4.9 up to and including 4.9.21
From 5.0 up to and including 5.0.17
From 5.1 up to and including 5.1.14
From 5.2 up to and including 5.2.16
From 5.3 up to and including 5.3.13
From 5.4 up to and including 5.4.11
From 5.5 up to and including 5.5.10
From 5.6 up to and including 5.6.9
From 5.7 up to and including 5.7.7
From 5.8 up to and including 5.8.5
From 5.9 up to and including 5.9.4
From 6.0 up to and including 6.0.2

Fixed in

3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3

What to do

If your site has an affected version, update WordPress to version 6.0.3 or newer.

Official ID

CVE-2022-43500

Report title

WordPress Core < 6.0.3 & Gutenberg < 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks

First reported

18 October 2022

Sources

Wordfence, seen 18 October 2022

This week

Someone could use it to harm your site (up to and including 3.6.1; from 3.7 up to and including 3.7.39; from 3.8 up to and including 3.8.39; from 3.9 up to and including 3.9.37; from 4.0 up to and including 4.0.36; from 4.1 up to and including 4.1.36; from 4.2 up to and including 4.2.33; from 4.3 up to and including 4.3.29; from 4.4 up to and including 4.4.28; from 4.5 up to and including 4.5.27; from 4.6 up to and including 4.6.24; from 4.7 up to and including 4.7.24; from 4.8 up to and including 4.8.20; from 4.9 up to and including 4.9.21; from 5.0 up to and including 5.0.17; from 5.1 up to and including 5.1.14; from 5.2 up to and including 5.2.16; from 5.3 up to and including 5.3.13; from 5.4 up to and including 5.4.11; from 5.5 up to and including 5.5.10; from 5.6 up to and including 5.6.9; from 5.7 up to and including 5.7.7; from 5.8 up to and including 5.8.5; from 5.9 up to and including 5.9.4; from 6.0 up to and including 6.0.2) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.39
From 3.8 up to and including 3.8.39
From 3.9 up to and including 3.9.37
From 4.0 up to and including 4.0.36
From 4.1 up to and including 4.1.36
From 4.2 up to and including 4.2.33
From 4.3 up to and including 4.3.29
From 4.4 up to and including 4.4.28
From 4.5 up to and including 4.5.27
From 4.6 up to and including 4.6.24
From 4.7 up to and including 4.7.24
From 4.8 up to and including 4.8.20
From 4.9 up to and including 4.9.21
From 5.0 up to and including 5.0.17
From 5.1 up to and including 5.1.14
From 5.2 up to and including 5.2.16
From 5.3 up to and including 5.3.13
From 5.4 up to and including 5.4.11
From 5.5 up to and including 5.5.10
From 5.6 up to and including 5.6.9
From 5.7 up to and including 5.7.7
From 5.8 up to and including 5.8.5
From 5.9 up to and including 5.9.4
From 6.0 up to and including 6.0.2

Fixed in

3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3

What to do

If your site has an affected version, update WordPress to version 6.0.3 or newer.

Report title

WordPress Core < 6.0.3 - Authenticated Information Disclosure via REST-API

First reported

18 October 2022

Sources

Wordfence, seen 18 October 2022

This week

Someone could read or change the data in your site’s database (up to and including 3.6.1; from 3.7 up to and including 3.7.39; from 3.8 up to and including 3.8.39; from 3.9 up to and including 3.9.37; from 4.0 up to and including 4.0.36; from 4.1 up to and including 4.1.36; from 4.2 up to and including 4.2.33; from 4.3 up to and including 4.3.29; from 4.4 up to and including 4.4.28; from 4.5 up to and including 4.5.27; from 4.6 up to and including 4.6.24; from 4.7 up to and including 4.7.24; from 4.8 up to and including 4.8.20; from 4.9 up to and including 4.9.21; from 5.0 up to and including 5.0.17; from 5.1 up to and including 5.1.14; from 5.2 up to and including 5.2.16; from 5.3 up to and including 5.3.13; from 5.4 up to and including 5.4.11; from 5.5 up to and including 5.5.10; from 5.6 up to and including 5.6.9; from 5.7 up to and including 5.7.7; from 5.8 up to and including 5.8.5; from 5.9 up to and including 5.9.4; from 6.0 up to and including 6.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.39
From 3.8 up to and including 3.8.39
From 3.9 up to and including 3.9.37
From 4.0 up to and including 4.0.36
From 4.1 up to and including 4.1.36
From 4.2 up to and including 4.2.33
From 4.3 up to and including 4.3.29
From 4.4 up to and including 4.4.28
From 4.5 up to and including 4.5.27
From 4.6 up to and including 4.6.24
From 4.7 up to and including 4.7.24
From 4.8 up to and including 4.8.20
From 4.9 up to and including 4.9.21
From 5.0 up to and including 5.0.17
From 5.1 up to and including 5.1.14
From 5.2 up to and including 5.2.16
From 5.3 up to and including 5.3.13
From 5.4 up to and including 5.4.11
From 5.5 up to and including 5.5.10
From 5.6 up to and including 5.6.9
From 5.7 up to and including 5.7.7
From 5.8 up to and including 5.8.5
From 5.9 up to and including 5.9.4
From 6.0 up to and including 6.0.2

Fixed in

3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3

What to do

If your site has an affected version, update WordPress to version 6.0.3 or newer.

Official ID

CVE-2022-43497

Report title

WordPress Core < 6.0.3 - Reflected Cross-Site Scripting via SQL Injection

First reported

18 October 2022

Sources

Wordfence, seen 18 October 2022

This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.6.1; from 3.7 up to and including 3.7.39; from 3.8 up to and including 3.8.39; from 3.9 up to and including 3.9.37; from 4.0 up to and including 4.0.36; from 4.1 up to and including 4.1.36; from 4.2 up to and including 4.2.33; from 4.3 up to and including 4.3.29; from 4.4 up to and including 4.4.28; from 4.5 up to and including 4.5.27; from 4.6 up to and including 4.6.24; from 4.7 up to and including 4.7.24; from 4.8 up to and including 4.8.20; from 4.9 up to and including 4.9.21; from 5.0 up to and including 5.0.17; from 5.1 up to and including 5.1.14; from 5.2 up to and including 5.2.16; from 5.3 up to and including 5.3.13; from 5.4 up to and including 5.4.11; from 5.5 up to and including 5.5.10; from 5.6 up to and including 5.6.9; from 5.7 up to and including 5.7.7; from 5.8 up to and including 5.8.5; from 5.9 up to and including 5.9.4; from 6.0 up to and including 6.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.39
From 3.8 up to and including 3.8.39
From 3.9 up to and including 3.9.37
From 4.0 up to and including 4.0.36
From 4.1 up to and including 4.1.36
From 4.2 up to and including 4.2.33
From 4.3 up to and including 4.3.29
From 4.4 up to and including 4.4.28
From 4.5 up to and including 4.5.27
From 4.6 up to and including 4.6.24
From 4.7 up to and including 4.7.24
From 4.8 up to and including 4.8.20
From 4.9 up to and including 4.9.21
From 5.0 up to and including 5.0.17
From 5.1 up to and including 5.1.14
From 5.2 up to and including 5.2.16
From 5.3 up to and including 5.3.13
From 5.4 up to and including 5.4.11
From 5.5 up to and including 5.5.10
From 5.6 up to and including 5.6.9
From 5.7 up to and including 5.7.7
From 5.8 up to and including 5.8.5
From 5.9 up to and including 5.9.4
From 6.0 up to and including 6.0.2

Fixed in

3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3

What to do

If your site has an affected version, update WordPress to version 6.0.3 or newer.

Report title

WordPress Core < 6.0.3 - Cross-Site Request Forgery via wp-trackback.php

First reported

18 October 2022

Sources

Wordfence, seen 18 October 2022

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.6.1; from 3.7 up to and including 3.7.39; from 3.8 up to and including 3.8.39; from 3.9 up to and including 3.9.37; from 4.0 up to and including 4.0.36; from 4.1 up to and including 4.1.36; from 4.2 up to and including 4.2.33; from 4.3 up to and including 4.3.29; from 4.4 up to and including 4.4.28; from 4.5 up to and including 4.5.27; from 4.6 up to and including 4.6.24; from 4.7 up to and including 4.7.24; from 4.8 up to and including 4.8.20; from 4.9 up to and including 4.9.21; from 5.0 up to and including 5.0.17; from 5.1 up to and including 5.1.14; from 5.2 up to and including 5.2.16; from 5.3 up to and including 5.3.13; from 5.4 up to and including 5.4.11; from 5.5 up to and including 5.5.10; from 5.6 up to and including 5.6.9; from 5.7 up to and including 5.7.7; from 5.8 up to and including 5.8.5; from 5.9 up to and including 5.9.4; from 6.0 up to and including 6.0.2) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.39
From 3.8 up to and including 3.8.39
From 3.9 up to and including 3.9.37
From 4.0 up to and including 4.0.36
From 4.1 up to and including 4.1.36
From 4.2 up to and including 4.2.33
From 4.3 up to and including 4.3.29
From 4.4 up to and including 4.4.28
From 4.5 up to and including 4.5.27
From 4.6 up to and including 4.6.24
From 4.7 up to and including 4.7.24
From 4.8 up to and including 4.8.20
From 4.9 up to and including 4.9.21
From 5.0 up to and including 5.0.17
From 5.1 up to and including 5.1.14
From 5.2 up to and including 5.2.16
From 5.3 up to and including 5.3.13
From 5.4 up to and including 5.4.11
From 5.5 up to and including 5.5.10
From 5.6 up to and including 5.6.9
From 5.7 up to and including 5.7.7
From 5.8 up to and including 5.8.5
From 5.9 up to and including 5.9.4
From 6.0 up to and including 6.0.2

Fixed in

3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3

What to do

If your site has an affected version, update WordPress to version 6.0.3 or newer.

Official ID

CVE-2022-43504

Report title

WordPress Core < 6.0.3 - Stored Cross-Site Scripting via wp-mail.php

First reported

18 October 2022

Sources

Wordfence, seen 18 October 2022

This week

Someone could use it to harm your site (up to and including 3.6.1; from 3.7 up to and including 3.7.39; from 3.8 up to and including 3.8.39; from 3.9 up to and including 3.9.37; from 4.0 up to and including 4.0.36; from 4.1 up to and including 4.1.36; from 4.2 up to and including 4.2.33; from 4.3 up to and including 4.3.29; from 4.4 up to and including 4.4.28; from 4.5 up to and including 4.5.27; from 4.6 up to and including 4.6.24; from 4.7 up to and including 4.7.24; from 4.8 up to and including 4.8.20; from 4.9 up to and including 4.9.21; from 5.0 up to and including 5.0.17; from 5.1 up to and including 5.1.14; from 5.2 up to and including 5.2.16; from 5.3 up to and including 5.3.13; from 5.4 up to and including 5.4.11; from 5.5 up to and including 5.5.10; from 5.6 up to and including 5.6.9; from 5.7 up to and including 5.7.7; from 5.8 up to and including 5.8.5; from 5.9 up to and including 5.9.4; from 6.0 up to and including 6.0.2) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.39
From 3.8 up to and including 3.8.39
From 3.9 up to and including 3.9.37
From 4.0 up to and including 4.0.36
From 4.1 up to and including 4.1.36
From 4.2 up to and including 4.2.33
From 4.3 up to and including 4.3.29
From 4.4 up to and including 4.4.28
From 4.5 up to and including 4.5.27
From 4.6 up to and including 4.6.24
From 4.7 up to and including 4.7.24
From 4.8 up to and including 4.8.20
From 4.9 up to and including 4.9.21
From 5.0 up to and including 5.0.17
From 5.1 up to and including 5.1.14
From 5.2 up to and including 5.2.16
From 5.3 up to and including 5.3.13
From 5.4 up to and including 5.4.11
From 5.5 up to and including 5.5.10
From 5.6 up to and including 5.6.9
From 5.7 up to and including 5.7.7
From 5.8 up to and including 5.8.5
From 5.9 up to and including 5.9.4
From 6.0 up to and including 6.0.2

Fixed in

3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3

What to do

If your site has an affected version, update WordPress to version 6.0.3 or newer.

Official ID

CVE-2022-43504

Report title

WordPress Core < 6.0.3 - Information Disclosure (Email Address)

First reported

18 October 2022

Sources

Wordfence, seen 18 October 2022

This week

Someone with an editor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.6.1; from 3.7 up to and including 3.7.39; from 3.8 up to and including 3.8.39; from 3.9 up to and including 3.9.37; from 4.0 up to and including 4.0.36; from 4.1 up to and including 4.1.36; from 4.2 up to and including 4.2.33; from 4.3 up to and including 4.3.29; from 4.4 up to and including 4.4.28; from 4.5 up to and including 4.5.27; from 4.6 up to and including 4.6.24; from 4.7 up to and including 4.7.24; from 4.8 up to and including 4.8.20; from 4.9 up to and including 4.9.21; from 5.0 up to and including 5.0.17; from 5.1 up to and including 5.1.14; from 5.2 up to and including 5.2.16; from 5.3 up to and including 5.3.13; from 5.4 up to and including 5.4.11; from 5.5 up to and including 5.5.10; from 5.6 up to and including 5.6.9; from 5.7 up to and including 5.7.7; from 5.8 up to and including 5.8.5; from 5.9 up to and including 5.9.4; from 6.0 up to and including 6.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.39
From 3.8 up to and including 3.8.39
From 3.9 up to and including 3.9.37
From 4.0 up to and including 4.0.36
From 4.1 up to and including 4.1.36
From 4.2 up to and including 4.2.33
From 4.3 up to and including 4.3.29
From 4.4 up to and including 4.4.28
From 4.5 up to and including 4.5.27
From 4.6 up to and including 4.6.24
From 4.7 up to and including 4.7.24
From 4.8 up to and including 4.8.20
From 4.9 up to and including 4.9.21
From 5.0 up to and including 5.0.17
From 5.1 up to and including 5.1.14
From 5.2 up to and including 5.2.16
From 5.3 up to and including 5.3.13
From 5.4 up to and including 5.4.11
From 5.5 up to and including 5.5.10
From 5.6 up to and including 5.6.9
From 5.7 up to and including 5.7.7
From 5.8 up to and including 5.8.5
From 5.9 up to and including 5.9.4
From 6.0 up to and including 6.0.2

Fixed in

3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3

What to do

If your site has an affected version, update WordPress to version 6.0.3 or newer.

Report title

WordPress Core < 6.0.3 - Authenticated (Editor+) Stored Cross-Site Scripting via Comments

First reported

18 October 2022

Sources

Wordfence, seen 18 October 2022

This week

Someone could read or change the data in your site’s database (up to and including 3.6.1; from 3.7 up to and including 3.7.39; from 3.8 up to and including 3.8.39; from 3.9 up to and including 3.9.37; from 4.0 up to and including 4.0.36; from 4.1 up to and including 4.1.36; from 4.2 up to and including 4.2.33; from 4.3 up to and including 4.3.29; from 4.4 up to and including 4.4.28; from 4.5 up to and including 4.5.27; from 4.6 up to and including 4.6.24; from 4.7 up to and including 4.7.24; from 4.8 up to and including 4.8.20; from 4.9 up to and including 4.9.21; from 5.0 up to and including 5.0.17; from 5.1 up to and including 5.1.14; from 5.2 up to and including 5.2.16; from 5.3 up to and including 5.3.13; from 5.4 up to and including 5.4.11; from 5.5 up to and including 5.5.10; from 5.6 up to and including 5.6.9; from 5.7 up to and including 5.7.7; from 5.8 up to and including 5.8.5; from 5.9 up to and including 5.9.4; from 6.0 up to and including 6.0.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.39
From 3.8 up to and including 3.8.39
From 3.9 up to and including 3.9.37
From 4.0 up to and including 4.0.36
From 4.1 up to and including 4.1.36
From 4.2 up to and including 4.2.33
From 4.3 up to and including 4.3.29
From 4.4 up to and including 4.4.28
From 4.5 up to and including 4.5.27
From 4.6 up to and including 4.6.24
From 4.7 up to and including 4.7.24
From 4.8 up to and including 4.8.20
From 4.9 up to and including 4.9.21
From 5.0 up to and including 5.0.17
From 5.1 up to and including 5.1.14
From 5.2 up to and including 5.2.16
From 5.3 up to and including 5.3.13
From 5.4 up to and including 5.4.11
From 5.5 up to and including 5.5.10
From 5.6 up to and including 5.6.9
From 5.7 up to and including 5.7.7
From 5.8 up to and including 5.8.5
From 5.9 up to and including 5.9.4
From 6.0 up to and including 6.0.2

Fixed in

3.7.40, 3.8.40, 3.9.38, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3

What to do

If your site has an affected version, update WordPress to version 6.0.3 or newer.

Report title

WordPress Core < 6.0.3 - SQL Injection via WP_Date_Query

First reported

18 October 2022

Sources

Wordfence, seen 18 October 2022

This week

A stranger could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.1.30 up to and including 6.1.1

Fixed in

No fixed version yet

What to do

There is no fixed version yet. If your site uses it, think about turning it off or replacing it until a fix comes out.

Official ID

CVE-2022-3590

Report title

WordPress Core - All known versions - Unauthenticated Blind Server Side Request Forgery

First reported

6 September 2022

Sources

Wordfence, seen 6 September 2022

This week

Someone could read or change the data in your site’s database (up to and including 3.6.1; from 3.7 up to and including 3.7.38; from 3.8 up to and including 3.8.38; from 3.9 up to and including 3.9.36; from 4.0 up to and including 4.0.35; from 4.1 up to and including 4.1.35; from 4.2 up to and including 4.2.32; from 4.3 up to and including 4.3.28; from 4.4 up to and including 4.4.27; from 4.5 up to and including 4.5.26; from 4.6 up to and including 4.6.23; from 4.7 up to and including 4.7.23; from 4.8 up to and including 4.8.19; from 4.9 up to and including 4.9.20; from 5.0 up to and including 5.0.16; from 5.1 up to and including 5.1.13; from 5.2 up to and including 5.2.15; from 5.3 up to and including 5.3.12; from 5.4 up to and including 5.4.10; from 5.5 up to and including 5.5.9; from 5.6 up to and including 5.6.8; from 5.7 up to and including 5.7.6; from 5.8 up to and including 5.8.4; from 5.9 up to and including 5.9.3; from 6.0 up to and including 6.0.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.38
From 3.8 up to and including 3.8.38
From 3.9 up to and including 3.9.36
From 4.0 up to and including 4.0.35
From 4.1 up to and including 4.1.35
From 4.2 up to and including 4.2.32
From 4.3 up to and including 4.3.28
From 4.4 up to and including 4.4.27
From 4.5 up to and including 4.5.26
From 4.6 up to and including 4.6.23
From 4.7 up to and including 4.7.23
From 4.8 up to and including 4.8.19
From 4.9 up to and including 4.9.20
From 5.0 up to and including 5.0.16
From 5.1 up to and including 5.1.13
From 5.2 up to and including 5.2.15
From 5.3 up to and including 5.3.12
From 5.4 up to and including 5.4.10
From 5.5 up to and including 5.5.9
From 5.6 up to and including 5.6.8
From 5.7 up to and including 5.7.6
From 5.8 up to and including 5.8.4
From 5.9 up to and including 5.9.3
From 6.0 up to and including 6.0.1

Fixed in

3.7.39, 3.8.39, 3.9.37, 4.0.36, 4.1.36, 4.2.33, 4.3.29, 4.4.28, 4.5.27, 4.6.24, 4.7.24, 4.8.20, 4.9.21, 5.0.17, 5.1.14, 5.2.16, 5.3.13, 5.4.11, 5.5.10, 5.6.9, 5.7.7, 5.8.5, 5.9.4, 6.0.2

What to do

If your site has an affected version, update WordPress to version 6.0.2 or newer.

Report title

WordPress Core < 6.0.2 - Authenticated SQL Injection

First reported

30 August 2022

Sources

Wordfence, seen 30 August 2022

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.6.1; from 3.7 up to and including 3.7.38; from 3.8 up to and including 3.8.38; from 3.9 up to and including 3.9.36; from 4.0 up to and including 4.0.35; from 4.1 up to and including 4.1.35; from 4.2 up to and including 4.2.32; from 4.3 up to and including 4.3.28; from 4.4 up to and including 4.4.27; from 4.5 up to and including 4.5.26; from 4.6 up to and including 4.6.23; from 4.7 up to and including 4.7.23; from 4.8 up to and including 4.8.19; from 4.9 up to and including 4.9.20; from 5.0 up to and including 5.0.16; from 5.1 up to and including 5.1.13; from 5.2 up to and including 5.2.15; from 5.3 up to and including 5.3.12; from 5.4 up to and including 5.4.10; from 5.5 up to and including 5.5.9; from 5.6 up to and including 5.6.8; from 5.7 up to and including 5.7.6; from 5.8 up to and including 5.8.4; from 5.9 up to and including 5.9.3; from 6.0 up to and including 6.0.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.38
From 3.8 up to and including 3.8.38
From 3.9 up to and including 3.9.36
From 4.0 up to and including 4.0.35
From 4.1 up to and including 4.1.35
From 4.2 up to and including 4.2.32
From 4.3 up to and including 4.3.28
From 4.4 up to and including 4.4.27
From 4.5 up to and including 4.5.26
From 4.6 up to and including 4.6.23
From 4.7 up to and including 4.7.23
From 4.8 up to and including 4.8.19
From 4.9 up to and including 4.9.20
From 5.0 up to and including 5.0.16
From 5.1 up to and including 5.1.13
From 5.2 up to and including 5.2.15
From 5.3 up to and including 5.3.12
From 5.4 up to and including 5.4.10
From 5.5 up to and including 5.5.9
From 5.6 up to and including 5.6.8
From 5.7 up to and including 5.7.6
From 5.8 up to and including 5.8.4
From 5.9 up to and including 5.9.3
From 6.0 up to and including 6.0.1

Fixed in

3.7.39, 3.8.39, 3.9.37, 4.0.36, 4.1.36, 4.2.33, 4.3.29, 4.4.28, 4.5.27, 4.6.24, 4.7.24, 4.8.20, 4.9.21, 5.0.17, 5.1.14, 5.2.16, 5.3.13, 5.4.11, 5.5.10, 5.6.9, 5.7.7, 5.8.5, 5.9.4, 6.0.2

What to do

If your site has an affected version, update WordPress to version 6.0.2 or newer.

Report title

WordPress Core < 6.0.2 - Stored Cross-Site Scripting via Plugin Deactivation and Deletion Errors

First reported

30 August 2022

Sources

Wordfence, seen 30 August 2022

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.6.1; from 3.7 up to and including 3.7.38; from 3.8 up to and including 3.8.38; from 3.9 up to and including 3.9.36; from 4.0 up to and including 4.0.35; from 4.1 up to and including 4.1.35; from 4.2 up to and including 4.2.32; from 4.3 up to and including 4.3.28; from 4.4 up to and including 4.4.27; from 4.5 up to and including 4.5.26; from 4.6 up to and including 4.6.23; from 4.7 up to and including 4.7.23; from 4.8 up to and including 4.8.19; from 4.9 up to and including 4.9.20; from 5.0 up to and including 5.0.16; from 5.1 up to and including 5.1.13; from 5.2 up to and including 5.2.15; from 5.3 up to and including 5.3.12; from 5.4 up to and including 5.4.10; from 5.5 up to and including 5.5.9; from 5.6 up to and including 5.6.8; from 5.7 up to and including 5.7.6; from 5.8 up to and including 5.8.4; from 5.9 up to and including 5.9.3; from 6.0 up to and including 6.0.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.38
From 3.8 up to and including 3.8.38
From 3.9 up to and including 3.9.36
From 4.0 up to and including 4.0.35
From 4.1 up to and including 4.1.35
From 4.2 up to and including 4.2.32
From 4.3 up to and including 4.3.28
From 4.4 up to and including 4.4.27
From 4.5 up to and including 4.5.26
From 4.6 up to and including 4.6.23
From 4.7 up to and including 4.7.23
From 4.8 up to and including 4.8.19
From 4.9 up to and including 4.9.20
From 5.0 up to and including 5.0.16
From 5.1 up to and including 5.1.13
From 5.2 up to and including 5.2.15
From 5.3 up to and including 5.3.12
From 5.4 up to and including 5.4.10
From 5.5 up to and including 5.5.9
From 5.6 up to and including 5.6.8
From 5.7 up to and including 5.7.6
From 5.8 up to and including 5.8.4
From 5.9 up to and including 5.9.3
From 6.0 up to and including 6.0.1

Fixed in

3.7.39, 3.8.39, 3.9.37, 4.0.36, 4.1.36, 4.2.33, 4.3.29, 4.4.28, 4.5.27, 4.6.24, 4.7.24, 4.8.20, 4.9.21, 5.0.17, 5.1.14, 5.2.16, 5.3.13, 5.4.11, 5.5.10, 5.6.9, 5.7.7, 5.8.5, 5.9.4, 6.0.2

What to do

If your site has an affected version, update WordPress to version 6.0.2 or newer.

Official ID

CVE-2022-4973

Report title

WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function

First reported

30 August 2022

Sources

Wordfence, seen 30 August 2022

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (from 5.9 up to, but not including, 5.9.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.9 up to, but not including, 5.9.2

Fixed in

5.9.2

What to do

If your site has an affected version, update WordPress to version 5.9.2 or newer.

Report title

WordPress Core 5.9 - 5.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

First reported

11 March 2022

Sources

Wordfence, seen 11 March 2022

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.37; from 3.8 up to and including 3.8.37; from 3.9 up to and including 3.9.35; from 4.0 up to and including 4.0.34; from 4.1 up to and including 4.1.34; from 4.2 up to and including 4.2.31; from 4.3 up to and including 4.3.27; from 4.4 up to and including 4.4.26; from 4.5 up to and including 4.5.25; from 4.6 up to and including 4.6.22; from 4.7 up to and including 4.7.22; from 4.8 up to and including 4.8.18; from 4.9 up to and including 4.9.19; from 5.0 up to and including 5.0.15; from 5.1 up to and including 5.1.12; from 5.2 up to and including 5.2.14; from 5.3 up to and including 5.3.11; from 5.4 up to and including 5.4.9; from 5.5 up to and including 5.5.8; from 5.6 up to and including 5.6.7; from 5.7 up to and including 5.7.5; from 5.8 up to and including 5.8.3; from 5.9 up to and including 5.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.37
From 3.8 up to and including 3.8.37
From 3.9 up to and including 3.9.35
From 4.0 up to and including 4.0.34
From 4.1 up to and including 4.1.34
From 4.2 up to and including 4.2.31
From 4.3 up to and including 4.3.27
From 4.4 up to and including 4.4.26
From 4.5 up to and including 4.5.25
From 4.6 up to and including 4.6.22
From 4.7 up to and including 4.7.22
From 4.8 up to and including 4.8.18
From 4.9 up to and including 4.9.19
From 5.0 up to and including 5.0.15
From 5.1 up to and including 5.1.12
From 5.2 up to and including 5.2.14
From 5.3 up to and including 5.3.11
From 5.4 up to and including 5.4.9
From 5.5 up to and including 5.5.8
From 5.6 up to and including 5.6.7
From 5.7 up to and including 5.7.5
From 5.8 up to and including 5.8.3
From 5.9 up to and including 5.9.1

Fixed in

3.7.38, 3.8.38, 3.9.36, 4.0.35, 4.1.35, 4.2.32, 4.3.28, 4.4.27, 4.5.26, 4.6.23, 4.7.23, 4.8.19, 4.9.20, 5.0.16, 5.1.13, 5.2.15, 5.3.12, 5.4.10, 5.5.9, 5.6.8, 5.7.6, 5.8.4, 5.9.2

What to do

If your site has an affected version, update WordPress to version 5.9.2 or newer.

Report title

WordPress Core < 5.9.2 & Gutenberg < 12.7.2 - Prototype Pollution via Block Editor

First reported

11 March 2022

Sources

Wordfence, seen 11 March 2022

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.37; from 3.8 up to and including 3.8.37; from 3.9 up to and including 3.9.35; from 4.0 up to and including 4.0.34; from 4.1 up to and including 4.1.34; from 4.2 up to and including 4.2.31; from 4.3 up to and including 4.3.27; from 4.4 up to and including 4.4.26; from 4.5 up to and including 4.5.25; from 4.6 up to and including 4.6.22; from 4.7 up to and including 4.7.22; from 4.8 up to and including 4.8.18; from 4.9 up to and including 4.9.19; from 5.0 up to and including 5.0.15; from 5.1 up to and including 5.1.12; from 5.2 up to and including 5.2.14; from 5.3 up to and including 5.3.11; from 5.4 up to and including 5.4.9; from 5.5 up to and including 5.5.8; from 5.6 up to and including 5.6.7; from 5.7 up to and including 5.7.5; from 5.8 up to and including 5.8.3; from 5.9 up to and including 5.9.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.37
From 3.8 up to and including 3.8.37
From 3.9 up to and including 3.9.35
From 4.0 up to and including 4.0.34
From 4.1 up to and including 4.1.34
From 4.2 up to and including 4.2.31
From 4.3 up to and including 4.3.27
From 4.4 up to and including 4.4.26
From 4.5 up to and including 4.5.25
From 4.6 up to and including 4.6.22
From 4.7 up to and including 4.7.22
From 4.8 up to and including 4.8.18
From 4.9 up to and including 4.9.19
From 5.0 up to and including 5.0.15
From 5.1 up to and including 5.1.12
From 5.2 up to and including 5.2.14
From 5.3 up to and including 5.3.11
From 5.4 up to and including 5.4.9
From 5.5 up to and including 5.5.8
From 5.6 up to and including 5.6.7
From 5.7 up to and including 5.7.5
From 5.8 up to and including 5.8.3
From 5.9 up to and including 5.9.1

Fixed in

3.7.38, 3.8.38, 3.9.36, 4.0.35, 4.1.35, 4.2.32, 4.3.28, 4.4.27, 4.5.26, 4.6.23, 4.7.23, 4.8.19, 4.9.20, 5.0.16, 5.1.13, 5.2.15, 5.3.12, 5.4.10, 5.5.9, 5.6.8, 5.7.6, 5.8.4, 5.9.2

What to do

If your site has an affected version, update WordPress to version 5.9.2 or newer.

Official ID

CVE-2021-20083

Report title

WordPress Core < 5.9.1 - jQuery Prototype Pollution

First reported

11 March 2022

Sources

Wordfence, seen 11 March 2022

This week

Someone could read or change the data in your site’s database (from 4.1 up to, but not including, 4.1.34; from 4.2 up to, but not including, 4.2.31; from 4.3 up to, but not including, 4.3.27; from 4.4 up to, but not including, 4.4.26; from 4.5 up to, but not including, 4.5.25; from 4.6 up to, but not including, 4.6.22; from 4.7 up to, but not including, 4.7.22; from 4.8 up to, but not including, 4.8.18; from 4.9 up to, but not including, 4.9.19; from 5.0 up to, but not including, 5.0.15; from 5.1 up to, but not including, 5.1.12; from 5.2 up to, but not including, 5.2.14; from 5.3 up to, but not including, 5.3.11; from 5.4 up to, but not including, 5.4.9; from 5.5 up to, but not including, 5.5.8; from 5.6 up to, but not including, 5.6.7; from 5.7 up to, but not including, 5.7.5; from 5.8 up to, but not including, 5.8.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.1 up to, but not including, 4.1.34
From 4.2 up to, but not including, 4.2.31
From 4.3 up to, but not including, 4.3.27
From 4.4 up to, but not including, 4.4.26
From 4.5 up to, but not including, 4.5.25
From 4.6 up to, but not including, 4.6.22
From 4.7 up to, but not including, 4.7.22
From 4.8 up to, but not including, 4.8.18
From 4.9 up to, but not including, 4.9.19
From 5.0 up to, but not including, 5.0.15
From 5.1 up to, but not including, 5.1.12
From 5.2 up to, but not including, 5.2.14
From 5.3 up to, but not including, 5.3.11
From 5.4 up to, but not including, 5.4.9
From 5.5 up to, but not including, 5.5.8
From 5.6 up to, but not including, 5.6.7
From 5.7 up to, but not including, 5.7.5
From 5.8 up to, but not including, 5.8.3

Fixed in

4.1.34, 4.2.31, 4.3.27, 4.4.26, 4.5.25, 4.6.22, 4.7.22, 4.8.18, 4.9.19, 5.0.15, 5.1.12, 5.2.14, 5.3.11, 5.4.9, 5.5.8, 5.6.7, 5.7.5, 5.8.3

What to do

If your site has an affected version, update WordPress to version 5.8.3 or newer.

Official ID

CVE-2022-21664

Report title

WordPress Core < 5.8.3 - SQL Injection via WP_Meta_Query

First reported

6 January 2022

Sources

Wordfence, seen 6 January 2022

This week

Someone could use it to harm your site (from 3.7 up to, but not including, 3.7.37; from 3.8 up to, but not including, 3.8.37; from 3.9 up to, but not including, 3.9.35; from 4.0 up to, but not including, 4.0.34; from 4.1 up to, but not including, 4.1.34; from 4.2 up to, but not including, 4.2.31; from 4.3 up to, but not including, 4.3.27; from 4.4 up to, but not including, 4.4.26; from 4.5 up to, but not including, 4.5.25; from 4.6 up to, but not including, 4.6.22; from 4.7 up to, but not including, 4.7.22; from 4.8 up to, but not including, 4.8.18; from 4.9 up to, but not including, 4.9.19; from 5.0 up to, but not including, 5.0.15; from 5.1 up to, but not including, 5.1.12; from 5.2 up to, but not including, 5.2.14; from 5.3 up to, but not including, 5.3.11; from 5.4 up to, but not including, 5.4.9; from 5.5 up to, but not including, 5.5.8; from 5.6 up to, but not including, 5.6.7; from 5.7 up to, but not including, 5.7.5; from 5.8 up to, but not including, 5.8.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 3.7 up to, but not including, 3.7.37
From 3.8 up to, but not including, 3.8.37
From 3.9 up to, but not including, 3.9.35
From 4.0 up to, but not including, 4.0.34
From 4.1 up to, but not including, 4.1.34
From 4.2 up to, but not including, 4.2.31
From 4.3 up to, but not including, 4.3.27
From 4.4 up to, but not including, 4.4.26
From 4.5 up to, but not including, 4.5.25
From 4.6 up to, but not including, 4.6.22
From 4.7 up to, but not including, 4.7.22
From 4.8 up to, but not including, 4.8.18
From 4.9 up to, but not including, 4.9.19
From 5.0 up to, but not including, 5.0.15
From 5.1 up to, but not including, 5.1.12
From 5.2 up to, but not including, 5.2.14
From 5.3 up to, but not including, 5.3.11
From 5.4 up to, but not including, 5.4.9
From 5.5 up to, but not including, 5.5.8
From 5.6 up to, but not including, 5.6.7
From 5.7 up to, but not including, 5.7.5
From 5.8 up to, but not including, 5.8.3

Fixed in

3.7.37, 3.8.37, 3.9.35, 4.0.34, 4.1.34, 4.2.31, 4.3.27, 4.4.26, 4.5.25, 4.6.22, 4.7.22, 4.8.18, 4.9.19, 5.0.15, 5.1.12, 5.2.14, 5.3.11, 5.4.9, 5.5.8, 5.6.7, 5.7.5, 5.8.3

What to do

If your site has an affected version, update WordPress to version 5.8.3 or newer.

Official ID

CVE-2022-21663

Report title

WordPress Core < 5.8.3 - Super Admin Multi-Site Installation Object Injection

First reported

6 January 2022

Sources

Wordfence, seen 6 January 2022

This week

Someone with an author account on your site could use it to harm your site (from 3.7 up to, but not including, 3.7.37; from 3.8 up to, but not including, 3.8.37; from 3.9 up to, but not including, 3.9.35; from 4.0 up to, but not including, 4.0.34; from 4.1 up to, but not including, 4.1.34; from 4.2 up to, but not including, 4.2.31; from 4.3 up to, but not including, 4.3.27; from 4.4 up to, but not including, 4.4.26; from 4.5 up to, but not including, 4.5.25; from 4.6 up to, but not including, 4.6.22; from 4.7 up to, but not including, 4.7.22; from 4.8 up to, but not including, 4.8.18; from 4.9 up to, but not including, 4.9.19; from 5.0 up to, but not including, 5.0.15; from 5.1 up to, but not including, 5.1.12; from 5.2 up to, but not including, 5.2.14; from 5.3 up to, but not including, 5.3.11; from 5.4 up to, but not including, 5.4.9; from 5.5 up to, but not including, 5.5.8; from 5.6 up to, but not including, 5.6.7; from 5.7 up to, but not including, 5.7.5; from 5.8 up to, but not including, 5.8.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 3.7 up to, but not including, 3.7.37
From 3.8 up to, but not including, 3.8.37
From 3.9 up to, but not including, 3.9.35
From 4.0 up to, but not including, 4.0.34
From 4.1 up to, but not including, 4.1.34
From 4.2 up to, but not including, 4.2.31
From 4.3 up to, but not including, 4.3.27
From 4.4 up to, but not including, 4.4.26
From 4.5 up to, but not including, 4.5.25
From 4.6 up to, but not including, 4.6.22
From 4.7 up to, but not including, 4.7.22
From 4.8 up to, but not including, 4.8.18
From 4.9 up to, but not including, 4.9.19
From 5.0 up to, but not including, 5.0.15
From 5.1 up to, but not including, 5.1.12
From 5.2 up to, but not including, 5.2.14
From 5.3 up to, but not including, 5.3.11
From 5.4 up to, but not including, 5.4.9
From 5.5 up to, but not including, 5.5.8
From 5.6 up to, but not including, 5.6.7
From 5.7 up to, but not including, 5.7.5
From 5.8 up to, but not including, 5.8.3

Fixed in

3.7.37, 3.8.37, 3.9.35, 4.0.34, 4.1.34, 4.2.31, 4.3.27, 4.4.26, 4.5.25, 4.6.22, 4.7.22, 4.8.18, 4.9.19, 5.0.15, 5.1.12, 5.2.14, 5.3.11, 5.4.9, 5.5.8, 5.6.7, 5.7.5, 5.8.3

What to do

If your site has an affected version, update WordPress to version 5.8.3 or newer.

Official ID

CVE-2022-21662

Report title

WordPress Core < 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting

First reported

6 January 2022

Sources

Wordfence, seen 6 January 2022

This week

Someone could use it to harm your site (up to and including 5.7.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 5.7.5

Fixed in

5.8

What to do

If your site has an affected version, update WordPress to version 5.8 or newer.

Official ID

CVE-2021-44223

Report title

WordPress Core < 5.8 - Dependency Confusion

First reported

25 November 2021

Sources

Wordfence, seen 25 November 2021

This week

Someone could use it to harm your site (before 5.2; from 5.2 up to and including 5.2.12; from 5.3 up to and including 5.3.9; from 5.4 up to and including 5.4.7; from 5.5 up to and including 5.5.6; from 5.6 up to and including 5.6.5; from 5.7 up to and including 5.7.3; from 5.8 up to and including 5.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 5.2
From 5.2 up to and including 5.2.12
From 5.3 up to and including 5.3.9
From 5.4 up to and including 5.4.7
From 5.5 up to and including 5.5.6
From 5.6 up to and including 5.6.5
From 5.7 up to and including 5.7.3
From 5.8 up to and including 5.8.1

Fixed in

5.2.13, 5.3.10, 5.4.8, 5.5.7, 5.6.6, 5.7.4, 5.8.2

What to do

If your site has an affected version, update WordPress to version 5.8.2 or newer.

Report title

WordPress Core < 5.8.2 - ca-bundle.crt contains expired certificate DST Root CA X3

First reported

10 November 2021

Sources

Wordfence, seen 10 November 2021

This week

Someone could use it to harm your site (from 5.4 up to, but not including, 5.4.7; from 5.5 up to, but not including, 5.5.6; from 5.6 up to, but not including, 5.6.5; from 5.7 up to, but not including, 5.7.3; from 5.8 up to, but not including, 5.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.4 up to, but not including, 5.4.7
From 5.5 up to, but not including, 5.5.6
From 5.6 up to, but not including, 5.6.5
From 5.7 up to, but not including, 5.7.3
From 5.8 up to, but not including, 5.8.1

Fixed in

5.4.7, 5.5.6, 5.6.5, 5.7.3, 5.8.1

What to do

If your site has an affected version, update WordPress to version 5.8.1 or newer.

Official ID

CVE-2020-8203

Report title

WordPress Core < 5.8.1 - LoDash Update

First reported

9 September 2021

Sources

Wordfence, seen 9 September 2021

This week

Someone could use it to harm your site (from 5.8 beta 1 up to and including 5.8 beta 1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.8 beta 1 up to and including 5.8 beta 1

Fixed in

5.8

What to do

If your site has an affected version, update WordPress to version 5.8 or newer.

Official ID

CVE-2021-39203

Report title

WordPress Core 5.8 beta - Block Editor Authorization Bypass

First reported

9 September 2021

Sources

Wordfence, seen 9 September 2021

This week

Someone could use it to harm your site (from 5.4 up to, but not including, 5.4.7; from 5.5 up to, but not including, 5.5.6; from 5.6 up to, but not including, 5.6.5; from 5.7 up to, but not including, 5.7.3; from 5.8 up to, but not including, 5.8.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.4 up to, but not including, 5.4.7
From 5.5 up to, but not including, 5.5.6
From 5.6 up to, but not including, 5.6.5
From 5.7 up to, but not including, 5.7.3
From 5.8 up to, but not including, 5.8.1

Fixed in

5.4.7, 5.5.6, 5.6.5, 5.7.3, 5.8.1

What to do

If your site has an affected version, update WordPress to version 5.8.1 or newer.

Official ID

CVE-2021-39200

Report title

WordPress Core 5.4 - 5.8 - Sensitive Information Disclosure

First reported

9 September 2021

Sources

Wordfence, seen 9 September 2021

This week

Someone could plant harmful code that runs for your visitors or admins (from 5.4 up to, but not including, 5.4.7; from 5.5 up to, but not including, 5.5.6; from 5.6 up to, but not including, 5.6.5; from 5.7 up to, but not including, 5.7.3; from 5.8 up to, but not including, 5.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.4 up to, but not including, 5.4.7
From 5.5 up to, but not including, 5.5.6
From 5.6 up to, but not including, 5.6.5
From 5.7 up to, but not including, 5.7.3
From 5.8 up to, but not including, 5.8.1

Fixed in

5.4.7, 5.5.6, 5.6.5, 5.7.3, 5.8.1

What to do

If your site has an affected version, update WordPress to version 5.8.1 or newer.

Official ID

CVE-2021-39201

Report title

WordPress Core 5.4 - 5.8 - Authenticated Stored Cross-Site Scripting

First reported

9 September 2021

Sources

Wordfence, seen 9 September 2021

This week

Someone could plant harmful code that runs for your visitors or admins (from 5.8 beta 1 up to and including 5.8 beta 2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 5.8 beta 1 up to and including 5.8 beta 2

Fixed in

5.8

What to do

If your site has an affected version, update WordPress to version 5.8 or newer.

Official ID

CVE-2021-39202

Report title

WordPress Core 5.8 beta - Stored Cross-Site Scripting in Custom HTML Block

First reported

9 September 2021

Sources

Wordfence, seen 9 September 2021

This week

Someone could use it to harm your site (from 4.7 up to, but not including, 4.7.20; from 4.8 up to, but not including, 4.8.16; from 4.9 up to, but not including, 4.9.17; from 5.0 up to, but not including, 5.0.12; from 5.1 up to, but not including, 5.1.9; from 5.2 up to, but not including, 5.2.10; from 5.3 up to, but not including, 5.3.7; from 5.4 up to, but not including, 5.4.5; from 5.5 up to, but not including, 5.5.4; from 5.6 up to, but not including, 5.6.3; from 5.7 up to, but not including, 5.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7 up to, but not including, 4.7.20
From 4.8 up to, but not including, 4.8.16
From 4.9 up to, but not including, 4.9.17
From 5.0 up to, but not including, 5.0.12
From 5.1 up to, but not including, 5.1.9
From 5.2 up to, but not including, 5.2.10
From 5.3 up to, but not including, 5.3.7
From 5.4 up to, but not including, 5.4.5
From 5.5 up to, but not including, 5.5.4
From 5.6 up to, but not including, 5.6.3
From 5.7 up to, but not including, 5.7.1

Fixed in

4.7.20, 4.8.16, 4.9.17, 5.0.12, 5.1.9, 5.2.10, 5.3.7, 5.4.5, 5.5.4, 5.6.3, 5.7.1

What to do

If your site has an affected version, update WordPress to version 5.7.1 or newer.

Official ID

CVE-2021-29447

Report title

WordPress Core < 5.7.1 - XXE Injection

First reported

15 April 2021

Sources

Wordfence, seen 15 April 2021

This week

Someone could use it to harm your site (from 4.7 up to, but not including, 4.7.20; from 4.8 up to, but not including, 4.8.16; from 4.9 up to, but not including, 4.9.17; from 5.0 up to, but not including, 5.0.12; from 5.1 up to, but not including, 5.1.9; from 5.2 up to, but not including, 5.2.10; from 5.3 up to, but not including, 5.3.7; from 5.4 up to, but not including, 5.4.5; from 5.5 up to, but not including, 5.5.4; from 5.6 up to, but not including, 5.6.3; from 5.7 up to, but not including, 5.7.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.7 up to, but not including, 4.7.20
From 4.8 up to, but not including, 4.8.16
From 4.9 up to, but not including, 4.9.17
From 5.0 up to, but not including, 5.0.12
From 5.1 up to, but not including, 5.1.9
From 5.2 up to, but not including, 5.2.10
From 5.3 up to, but not including, 5.3.7
From 5.4 up to, but not including, 5.4.5
From 5.5 up to, but not including, 5.5.4
From 5.6 up to, but not including, 5.6.3
From 5.7 up to, but not including, 5.7.1

Fixed in

4.7.20, 4.8.16, 4.9.17, 5.0.12, 5.1.9, 5.2.10, 5.3.7, 5.4.5, 5.5.4, 5.6.3, 5.7.1

What to do

If your site has an affected version, update WordPress to version 5.7.1 or newer.

Official ID

CVE-2021-29450

Report title

WordPress Core < 5.7.1 - Sensitive Information Disclosure

First reported

15 April 2021

Sources

Wordfence, seen 15 April 2021

This week

Someone could read or change the data in your site’s database (from 3.7 up to, but not including, 3.7.37; from 3.8 up to, but not including, 3.8.37; from 3.9 up to, but not including, 3.9.35; from 4.0 up to, but not including, 4.0.34; from 4.1 up to, but not including, 4.1.34; from 4.2 up to, but not including, 4.2.31; from 4.3 up to, but not including, 4.3.27; from 4.4 up to, but not including, 4.4.26; from 4.5 up to, but not including, 4.5.25; from 4.6 up to, but not including, 4.6.22; from 4.7 up to, but not including, 4.7.22; from 4.8 up to, but not including, 4.8.18; from 4.9 up to, but not including, 4.9.19; from 5.0 up to, but not including, 5.0.15; from 5.1 up to, but not including, 5.1.12; from 5.2 up to, but not including, 5.2.14; from 5.3 up to, but not including, 5.3.11; from 5.4 up to, but not including, 5.4.9; from 5.5 up to, but not including, 5.5.8; from 5.6 up to, but not including, 5.6.7; from 5.7 up to, but not including, 5.7.5; from 5.8 up to, but not including, 5.8.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 3.7 up to, but not including, 3.7.37
From 3.8 up to, but not including, 3.8.37
From 3.9 up to, but not including, 3.9.35
From 4.0 up to, but not including, 4.0.34
From 4.1 up to, but not including, 4.1.34
From 4.2 up to, but not including, 4.2.31
From 4.3 up to, but not including, 4.3.27
From 4.4 up to, but not including, 4.4.26
From 4.5 up to, but not including, 4.5.25
From 4.6 up to, but not including, 4.6.22
From 4.7 up to, but not including, 4.7.22
From 4.8 up to, but not including, 4.8.18
From 4.9 up to, but not including, 4.9.19
From 5.0 up to, but not including, 5.0.15
From 5.1 up to, but not including, 5.1.12
From 5.2 up to, but not including, 5.2.14
From 5.3 up to, but not including, 5.3.11
From 5.4 up to, but not including, 5.4.9
From 5.5 up to, but not including, 5.5.8
From 5.6 up to, but not including, 5.6.7
From 5.7 up to, but not including, 5.7.5
From 5.8 up to, but not including, 5.8.3

Fixed in

3.7.37, 3.8.37, 3.9.35, 4.0.34, 4.1.34, 4.2.31, 4.3.27, 4.4.26, 4.5.25, 4.6.22, 4.7.22, 4.8.18, 4.9.19, 5.0.15, 5.1.12, 5.2.14, 5.3.11, 5.4.9, 5.5.8, 5.6.7, 5.7.5, 5.8.3

What to do

If your site has an affected version, update WordPress to version 5.8.3 or newer.

Official ID

CVE-2022-21661

Report title

WordPress Core < 5.8.3 - SQL Injection via WP_Query

First reported

6 January 2021

Sources

Wordfence, seen 6 January 2021

This week

Someone could take over your site as an admin (before 3.7; from 3.7 up to and including 3.7.34; from 3.8 up to and including 3.8.34; from 3.9 up to and including 3.9.32; from 4.0 up to and including 4.0.31; from 4.1 up to and including 4.1.31; from 4.2 up to and including 4.2.28; from 4.3 up to and including 4.3.24; from 4.4 up to and including 4.4.23; from 4.5 up to and including 4.5.22; from 4.6 up to and including 4.6.19; from 4.7 up to and including 4.7.18; from 4.8 up to and including 4.8.14; from 4.9 up to and including 4.9.15; from 5.0 up to and including 5.0.10; from 5.1 up to and including 5.1.6; from 5.2 up to and including 5.2.7; from 5.3 up to and including 5.3.4; from 5.4 up to and including 5.4.2; from 5.5 up to and including 5.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.34
From 3.8 up to and including 3.8.34
From 3.9 up to and including 3.9.32
From 4.0 up to and including 4.0.31
From 4.1 up to and including 4.1.31
From 4.2 up to and including 4.2.28
From 4.3 up to and including 4.3.24
From 4.4 up to and including 4.4.23
From 4.5 up to and including 4.5.22
From 4.6 up to and including 4.6.19
From 4.7 up to and including 4.7.18
From 4.8 up to and including 4.8.14
From 4.9 up to and including 4.9.15
From 5.0 up to and including 5.0.10
From 5.1 up to and including 5.1.6
From 5.2 up to and including 5.2.7
From 5.3 up to and including 5.3.4
From 5.4 up to and including 5.4.2
From 5.5 up to and including 5.5.1

Fixed in

3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2

What to do

If your site has an affected version, update WordPress to version 5.5.2 or newer.

Official ID

CVE-2020-28036

Report title

WordPress Core < 5.5.2 - Privilege Escalation via XML-RPC

First reported

29 October 2020

Sources

Wordfence, seen 29 October 2020

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.34; from 3.8 up to and including 3.8.34; from 3.9 up to and including 3.9.32; from 4.0 up to and including 4.0.31; from 4.1 up to and including 4.1.31; from 4.2 up to and including 4.2.28; from 4.3 up to and including 4.3.24; from 4.4 up to and including 4.4.23; from 4.5 up to and including 4.5.22; from 4.6 up to and including 4.6.19; from 4.7 up to and including 4.7.18; from 4.8 up to and including 4.8.14; from 4.9 up to and including 4.9.15; from 5.0 up to and including 5.0.10; from 5.1 up to and including 5.1.6; from 5.2 up to and including 5.2.7; from 5.3 up to and including 5.3.4; from 5.4 up to and including 5.4.2; from 5.5 up to and including 5.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.34
From 3.8 up to and including 3.8.34
From 3.9 up to and including 3.9.32
From 4.0 up to and including 4.0.31
From 4.1 up to and including 4.1.31
From 4.2 up to and including 4.2.28
From 4.3 up to and including 4.3.24
From 4.4 up to and including 4.4.23
From 4.5 up to and including 4.5.22
From 4.6 up to and including 4.6.19
From 4.7 up to and including 4.7.18
From 4.8 up to and including 4.8.14
From 4.9 up to and including 4.9.15
From 5.0 up to and including 5.0.10
From 5.1 up to and including 5.1.6
From 5.2 up to and including 5.2.7
From 5.3 up to and including 5.3.4
From 5.4 up to and including 5.4.2
From 5.5 up to and including 5.5.1

Fixed in

3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2

What to do

If your site has an affected version, update WordPress to version 5.5.2 or newer.

Official ID

CVE-2020-28034

Report title

WordPress Core < 5.5.2 - Reflected Cross-Site Scripting via Global Variables

First reported

29 October 2020

Sources

Wordfence, seen 29 October 2020

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.34; from 3.8 up to and including 3.8.34; from 3.9 up to and including 3.9.32; from 4.0 up to and including 4.0.31; from 4.1 up to and including 4.1.31; from 4.2 up to and including 4.2.28; from 4.3 up to and including 4.3.24; from 4.4 up to and including 4.4.23; from 4.5 up to and including 4.5.22; from 4.6 up to and including 4.6.19; from 4.7 up to and including 4.7.18; from 4.8 up to and including 4.8.14; from 4.9 up to and including 4.9.15; from 5.0 up to and including 5.0.10; from 5.1 up to and including 5.1.6; from 5.2 up to and including 5.2.7; from 5.3 up to and including 5.3.4; from 5.4 up to and including 5.4.2; from 5.5 up to and including 5.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.34
From 3.8 up to and including 3.8.34
From 3.9 up to and including 3.9.32
From 4.0 up to and including 4.0.31
From 4.1 up to and including 4.1.31
From 4.2 up to and including 4.2.28
From 4.3 up to and including 4.3.24
From 4.4 up to and including 4.4.23
From 4.5 up to and including 4.5.22
From 4.6 up to and including 4.6.19
From 4.7 up to and including 4.7.18
From 4.8 up to and including 4.8.14
From 4.9 up to and including 4.9.15
From 5.0 up to and including 5.0.10
From 5.1 up to and including 5.1.6
From 5.2 up to and including 5.2.7
From 5.3 up to and including 5.3.4
From 5.4 up to and including 5.4.2
From 5.5 up to and including 5.5.1

Fixed in

3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2

What to do

If your site has an affected version, update WordPress to version 5.5.2 or newer.

Official ID

CVE-2020-28032

Report title

WordPress Core < 5.5.2 - Deserialization Gadget

First reported

29 October 2020

Sources

Wordfence, seen 29 October 2020

This week

Someone could in some setups, take over your site (before 3.7; from 3.7 up to, but not including, 3.7.35; from 3.8 up to, but not including, 3.8.35; from 3.9 up to, but not including, 3.9.33; from 4.0 up to, but not including, 4.0.32; from 4.1 up to, but not including, 4.1.32; from 4.2 up to, but not including, 4.2.29; from 4.3 up to, but not including, 4.3.25; from 4.4 up to, but not including, 4.4.24; from 4.5 up to, but not including, 4.5.23; from 4.6 up to, but not including, 4.6.20; from 4.7 up to, but not including, 4.7.19; from 4.8 up to, but not including, 4.8.15; from 4.9 up to, but not including, 4.9.16; from 5.0 up to, but not including, 5.0.11; from 5.1 up to, but not including, 5.1.8; from 5.2 up to, but not including, 5.2.9; from 5.3 up to, but not including, 5.3.6; from 5.4 up to, but not including, 5.4.4; from 5.5 up to, but not including, 5.5.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to, but not including, 3.7.35
From 3.8 up to, but not including, 3.8.35
From 3.9 up to, but not including, 3.9.33
From 4.0 up to, but not including, 4.0.32
From 4.1 up to, but not including, 4.1.32
From 4.2 up to, but not including, 4.2.29
From 4.3 up to, but not including, 4.3.25
From 4.4 up to, but not including, 4.4.24
From 4.5 up to, but not including, 4.5.23
From 4.6 up to, but not including, 4.6.20
From 4.7 up to, but not including, 4.7.19
From 4.8 up to, but not including, 4.8.15
From 4.9 up to, but not including, 4.9.16
From 5.0 up to, but not including, 5.0.11
From 5.1 up to, but not including, 5.1.8
From 5.2 up to, but not including, 5.2.9
From 5.3 up to, but not including, 5.3.6
From 5.4 up to, but not including, 5.4.4
From 5.5 up to, but not including, 5.5.3

Fixed in

3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.8, 5.2.9, 5.3.6, 5.4.4, 5.5.3

What to do

If your site has an affected version, update WordPress to version 5.5.3 or newer.

Official ID

CVE-2021-29476

Report title

WordPress Core < 5.5.3 - PHP Object Injection Gadget

First reported

29 October 2020

Sources

Wordfence, seen 29 October 2020

This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.7; from 3.7 up to and including 3.7.34; from 3.8 up to and including 3.8.34; from 3.9 up to and including 3.9.32; from 4.0 up to and including 4.0.31; from 4.1 up to and including 4.1.31; from 4.2 up to and including 4.2.28; from 4.3 up to and including 4.3.24; from 4.4 up to and including 4.4.23; from 4.5 up to and including 4.5.22; from 4.6 up to and including 4.6.19; from 4.7 up to and including 4.7.18; from 4.8 up to and including 4.8.14; from 4.9 up to and including 4.9.15; from 5.0 up to and including 5.0.10; from 5.1 up to and including 5.1.6; from 5.2 up to and including 5.2.7; from 5.3 up to and including 5.3.4; from 5.4 up to and including 5.4.2; from 5.5 up to and including 5.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.34
From 3.8 up to and including 3.8.34
From 3.9 up to and including 3.9.32
From 4.0 up to and including 4.0.31
From 4.1 up to and including 4.1.31
From 4.2 up to and including 4.2.28
From 4.3 up to and including 4.3.24
From 4.4 up to and including 4.4.23
From 4.5 up to and including 4.5.22
From 4.6 up to and including 4.6.19
From 4.7 up to and including 4.7.18
From 4.8 up to and including 4.8.14
From 4.9 up to and including 4.9.15
From 5.0 up to and including 5.0.10
From 5.1 up to and including 5.1.6
From 5.2 up to and including 5.2.7
From 5.3 up to and including 5.3.4
From 5.4 up to and including 5.4.2
From 5.5 up to and including 5.5.1

Fixed in

3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2

What to do

If your site has an affected version, update WordPress to version 5.5.2 or newer.

Official ID

CVE-2020-28040

Report title

WordPress Core < 5.5.2 - Cross-Site Request Forgery to Theme Image Change

First reported

29 October 2020

Sources

Wordfence, seen 29 October 2020

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.34; from 3.8 up to and including 3.8.34; from 3.9 up to and including 3.9.32; from 4.0 up to and including 4.0.31; from 4.1 up to and including 4.1.31; from 4.2 up to and including 4.2.28; from 4.3 up to and including 4.3.24; from 4.4 up to and including 4.4.23; from 4.5 up to and including 4.5.22; from 4.6 up to and including 4.6.19; from 4.7 up to and including 4.7.18; from 4.8 up to and including 4.8.14; from 4.9 up to and including 4.9.15; from 5.0 up to and including 5.0.10; from 5.1 up to and including 5.1.6; from 5.2 up to and including 5.2.7; from 5.3 up to and including 5.3.4; from 5.4 up to and including 5.4.2; from 5.5 up to and including 5.5.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.34
From 3.8 up to and including 3.8.34
From 3.9 up to and including 3.9.32
From 4.0 up to and including 4.0.31
From 4.1 up to and including 4.1.31
From 4.2 up to and including 4.2.28
From 4.3 up to and including 4.3.24
From 4.4 up to and including 4.4.23
From 4.5 up to and including 4.5.22
From 4.6 up to and including 4.6.19
From 4.7 up to and including 4.7.18
From 4.8 up to and including 4.8.14
From 4.9 up to and including 4.9.15
From 5.0 up to and including 5.0.10
From 5.1 up to and including 5.1.6
From 5.2 up to and including 5.2.7
From 5.3 up to and including 5.3.4
From 5.4 up to and including 5.4.2
From 5.5 up to and including 5.5.1

Fixed in

3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2

What to do

If your site has an affected version, update WordPress to version 5.5.2 or newer.

Official ID

CVE-2020-28038

Report title

WordPress Core < 5.5.2 - Stored Cross-Site Scripting via post slugs

First reported

29 October 2020

Sources

Wordfence, seen 29 October 2020

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.34; from 3.8 up to and including 3.8.34; from 3.9 up to and including 3.9.32; from 4.0 up to and including 4.0.31; from 4.1 up to and including 4.1.31; from 4.2 up to and including 4.2.28; from 4.3 up to and including 4.3.24; from 4.4 up to and including 4.4.23; from 4.5 up to and including 4.5.22; from 4.6 up to and including 4.6.19; from 4.7 up to and including 4.7.18; from 4.8 up to and including 4.8.14; from 4.9 up to and including 4.9.15; from 5.0 up to and including 5.0.10; from 5.1 up to and including 5.1.6; from 5.2 up to and including 5.2.7; from 5.3 up to and including 5.3.4; from 5.4 up to and including 5.4.2; from 5.5 up to and including 5.5.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.34
From 3.8 up to and including 3.8.34
From 3.9 up to and including 3.9.32
From 4.0 up to and including 4.0.31
From 4.1 up to and including 4.1.31
From 4.2 up to and including 4.2.28
From 4.3 up to and including 4.3.24
From 4.4 up to and including 4.4.23
From 4.5 up to and including 4.5.22
From 4.6 up to and including 4.6.19
From 4.7 up to and including 4.7.18
From 4.8 up to and including 4.8.14
From 4.9 up to and including 4.9.15
From 5.0 up to and including 5.0.10
From 5.1 up to and including 5.1.6
From 5.2 up to and including 5.2.7
From 5.3 up to and including 5.3.4
From 5.4 up to and including 5.4.2
From 5.5 up to and including 5.5.1

Fixed in

3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2

What to do

If your site has an affected version, update WordPress to version 5.5.2 or newer.

Official ID

CVE-2020-28037

Report title

WordPress Core < 5.5.2 - Misconfiguration That Allows Trigger of New Installation

First reported

29 October 2020

Sources

Wordfence, seen 29 October 2020

This week

Someone could read or delete private files on your server (before 3.7; from 3.7 up to and including 3.7.34; from 3.8 up to and including 3.8.34; from 3.9 up to and including 3.9.32; from 4.0 up to and including 4.0.31; from 4.1 up to and including 4.1.31; from 4.2 up to and including 4.2.28; from 4.3 up to and including 4.3.24; from 4.4 up to and including 4.4.23; from 4.5 up to and including 4.5.22; from 4.6 up to and including 4.6.19; from 4.7 up to and including 4.7.18; from 4.8 up to and including 4.8.14; from 4.9 up to and including 4.9.15; from 5.0 up to and including 5.0.10; from 5.1 up to and including 5.1.6; from 5.2 up to and including 5.2.7; from 5.3 up to and including 5.3.4; from 5.4 up to and including 5.4.2; from 5.5 up to and including 5.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.34
From 3.8 up to and including 3.8.34
From 3.9 up to and including 3.9.32
From 4.0 up to and including 4.0.31
From 4.1 up to and including 4.1.31
From 4.2 up to and including 4.2.28
From 4.3 up to and including 4.3.24
From 4.4 up to and including 4.4.23
From 4.5 up to and including 4.5.22
From 4.6 up to and including 4.6.19
From 4.7 up to and including 4.7.18
From 4.8 up to and including 4.8.14
From 4.9 up to and including 4.9.15
From 5.0 up to and including 5.0.10
From 5.1 up to and including 5.1.6
From 5.2 up to and including 5.2.7
From 5.3 up to and including 5.3.4
From 5.4 up to and including 5.4.2
From 5.5 up to and including 5.5.1

Fixed in

3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2

What to do

If your site has an affected version, update WordPress to version 5.5.2 or newer.

Official ID

CVE-2020-28039

Report title

WordPress Core < 5.5.2 - Arbitrary File Deletion

First reported

29 October 2020

Sources

Wordfence, seen 29 October 2020

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.34; from 3.8 up to and including 3.8.34; from 3.9 up to and including 3.9.32; from 4.0 up to and including 4.0.31; from 4.1 up to and including 4.1.31; from 4.2 up to and including 4.2.28; from 4.3 up to and including 4.3.24; from 4.4 up to and including 4.4.23; from 4.5 up to and including 4.5.22; from 4.6 up to and including 4.6.19; from 4.7 up to and including 4.7.18; from 4.8 up to and including 4.8.14; from 4.9 up to and including 4.9.15; from 5.0 up to and including 5.0.10; from 5.1 up to and including 5.1.6; from 5.2 up to and including 5.2.7; from 5.3 up to and including 5.3.4; from 5.4 up to and including 5.4.2; from 5.5 up to and including 5.5.1) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.34
From 3.8 up to and including 3.8.34
From 3.9 up to and including 3.9.32
From 4.0 up to and including 4.0.31
From 4.1 up to and including 4.1.31
From 4.2 up to and including 4.2.28
From 4.3 up to and including 4.3.24
From 4.4 up to and including 4.4.23
From 4.5 up to and including 4.5.22
From 4.6 up to and including 4.6.19
From 4.7 up to and including 4.7.18
From 4.8 up to and including 4.8.14
From 4.9 up to and including 4.9.15
From 5.0 up to and including 5.0.10
From 5.1 up to and including 5.1.6
From 5.2 up to and including 5.2.7
From 5.3 up to and including 5.3.4
From 5.4 up to and including 5.4.2
From 5.5 up to and including 5.5.1

Fixed in

3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2

What to do

If your site has an affected version, update WordPress to version 5.5.2 or newer.

Official ID

CVE-2020-28033

Report title

WordPress Core < 5.5.2 - Spam Embed on Multisite Installations

First reported

29 October 2020

Sources

Wordfence, seen 29 October 2020

This week

Someone could take over your site as an admin (before 3.7; from 3.7 up to and including 3.7.34; from 3.8 up to and including 3.8.34; from 3.9 up to and including 3.9.32; from 4.0 up to and including 4.0.31; from 4.1 up to and including 4.1.31; from 4.2 up to and including 4.2.28; from 4.3 up to and including 4.3.24; from 4.4 up to and including 4.4.23; from 4.5 up to and including 4.5.22; from 4.6 up to and including 4.6.19; from 4.7 up to and including 4.7.18; from 4.8 up to and including 4.8.14; from 4.9 up to and including 4.9.15; from 5.0 up to and including 5.0.10; from 5.1 up to and including 5.1.6; from 5.2 up to and including 5.2.7; from 5.3 up to and including 5.3.4; from 5.4 up to and including 5.4.2; from 5.5 up to and including 5.5.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.34
From 3.8 up to and including 3.8.34
From 3.9 up to and including 3.9.32
From 4.0 up to and including 4.0.31
From 4.1 up to and including 4.1.31
From 4.2 up to and including 4.2.28
From 4.3 up to and including 4.3.24
From 4.4 up to and including 4.4.23
From 4.5 up to and including 4.5.22
From 4.6 up to and including 4.6.19
From 4.7 up to and including 4.7.18
From 4.8 up to and including 4.8.14
From 4.9 up to and including 4.9.15
From 5.0 up to and including 5.0.10
From 5.1 up to and including 5.1.6
From 5.2 up to and including 5.2.7
From 5.3 up to and including 5.3.4
From 5.4 up to and including 5.4.2
From 5.5 up to and including 5.5.1

Fixed in

3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2

What to do

If your site has an affected version, update WordPress to version 5.5.2 or newer.

Official ID

CVE-2020-28035

Report title

WordPress Core < 5.5.2 - Privilege Escalation via XML-RPC

First reported

29 October 2020

Sources

Wordfence, seen 29 October 2020

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.33; from 3.8 up to and including 3.8.33; from 3.9 up to and including 3.9.31; from 4.0 up to and including 4.0.30; from 4.1 up to and including 4.1.30; from 4.2 up to and including 4.2.27; from 4.3 up to and including 4.3.23; from 4.4 up to and including 4.4.22; from 4.5 up to and including 4.5.21; from 4.6 up to and including 4.6.18; from 4.7 up to and including 4.7.17; from 4.8 up to and including 4.8.13; from 4.9 up to and including 4.9.14; from 5.0 up to and including 5.0.9; from 5.1 up to and including 5.1.5; from 5.2 up to and including 5.2.6; from 5.3 up to and including 5.3.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.33
From 3.8 up to and including 3.8.33
From 3.9 up to and including 3.9.31
From 4.0 up to and including 4.0.30
From 4.1 up to and including 4.1.30
From 4.2 up to and including 4.2.27
From 4.3 up to and including 4.3.23
From 4.4 up to and including 4.4.22
From 4.5 up to and including 4.5.21
From 4.6 up to and including 4.6.18
From 4.7 up to and including 4.7.17
From 4.8 up to and including 4.8.13
From 4.9 up to and including 4.9.14
From 5.0 up to and including 5.0.9
From 5.1 up to and including 5.1.5
From 5.2 up to and including 5.2.6
From 5.3 up to and including 5.3.3

Fixed in

3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2

What to do

If your site has an affected version, update WordPress to version 5.4.2 or newer.

Official ID

CVE-2020-4047

Report title

WordPress Core < 5.4.2 - Authenticated Stored Cross-Site Scripting

First reported

10 June 2020

Sources

Wordfence, seen 10 June 2020

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.33; from 3.8 up to and including 3.8.33; from 3.9 up to and including 3.9.31; from 4.0 up to and including 4.0.30; from 4.1 up to and including 4.1.30; from 4.2 up to and including 4.2.27; from 4.3 up to and including 4.3.23; from 4.4 up to and including 4.4.22; from 4.5 up to and including 4.5.21; from 4.6 up to and including 4.6.18; from 4.7 up to and including 4.7.17; from 4.8 up to and including 4.8.13; from 4.9 up to and including 4.9.14; from 5.0 up to and including 5.0.9; from 5.1 up to and including 5.1.5; from 5.2 up to and including 5.2.6; from 5.3 up to and including 5.3.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.33
From 3.8 up to and including 3.8.33
From 3.9 up to and including 3.9.31
From 4.0 up to and including 4.0.30
From 4.1 up to and including 4.1.30
From 4.2 up to and including 4.2.27
From 4.3 up to and including 4.3.23
From 4.4 up to and including 4.4.22
From 4.5 up to and including 4.5.21
From 4.6 up to and including 4.6.18
From 4.7 up to and including 4.7.17
From 4.8 up to and including 4.8.13
From 4.9 up to and including 4.9.14
From 5.0 up to and including 5.0.9
From 5.1 up to and including 5.1.5
From 5.2 up to and including 5.2.6
From 5.3 up to and including 5.3.3

Fixed in

3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2

What to do

If your site has an affected version, update WordPress to version 5.4.2 or newer.

Official ID

CVE-2020-4046

Report title

WordPress Core < 5.4.2 - Authenticated Stored Cross-Site Scripting

First reported

10 June 2020

Sources

Wordfence, seen 10 June 2020

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.33; from 3.8 up to and including 3.8.33; from 3.9 up to and including 3.9.31; from 4.0 up to and including 4.0.30; from 4.1 up to and including 4.1.30; from 4.2 up to and including 4.2.27; from 4.3 up to and including 4.3.23; from 4.4 up to and including 4.4.22; from 4.5 up to and including 4.5.21; from 4.6 up to and including 4.6.18; from 4.7 up to and including 4.7.17; from 4.8 up to and including 4.8.13; from 4.9 up to and including 4.9.14; from 5.0 up to and including 5.0.9; from 5.1 up to and including 5.1.5; from 5.2 up to and including 5.2.6; from 5.3 up to and including 5.3.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.33
From 3.8 up to and including 3.8.33
From 3.9 up to and including 3.9.31
From 4.0 up to and including 4.0.30
From 4.1 up to and including 4.1.30
From 4.2 up to and including 4.2.27
From 4.3 up to and including 4.3.23
From 4.4 up to and including 4.4.22
From 4.5 up to and including 4.5.21
From 4.6 up to and including 4.6.18
From 4.7 up to and including 4.7.17
From 4.8 up to and including 4.8.13
From 4.9 up to and including 4.9.14
From 5.0 up to and including 5.0.9
From 5.1 up to and including 5.1.5
From 5.2 up to and including 5.2.6
From 5.3 up to and including 5.3.3

Fixed in

3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2

What to do

If your site has an affected version, update WordPress to version 5.4.2 or newer.

Official ID

CVE-2020-25286

Report title

WordPress Core < 5.4.2 - Comment Disclosure

First reported

10 June 2020

Sources

Wordfence, seen 10 June 2020

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.33; from 3.8 up to and including 3.8.33; from 3.9 up to and including 3.9.31; from 4.0 up to and including 4.0.30; from 4.1 up to and including 4.1.30; from 4.2 up to and including 4.2.27; from 4.3 up to and including 4.3.23; from 4.4 up to and including 4.4.22; from 4.5 up to and including 4.5.21; from 4.6 up to and including 4.6.18; from 4.7 up to and including 4.7.17; from 4.8 up to and including 4.8.13; from 4.9 up to and including 4.9.14; from 5.0 up to and including 5.0.9; from 5.1 up to and including 5.1.5; from 5.2 up to and including 5.2.6; from 5.3 up to and including 5.3.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.33
From 3.8 up to and including 3.8.33
From 3.9 up to and including 3.9.31
From 4.0 up to and including 4.0.30
From 4.1 up to and including 4.1.30
From 4.2 up to and including 4.2.27
From 4.3 up to and including 4.3.23
From 4.4 up to and including 4.4.22
From 4.5 up to and including 4.5.21
From 4.6 up to and including 4.6.18
From 4.7 up to and including 4.7.17
From 4.8 up to and including 4.8.13
From 4.9 up to and including 4.9.14
From 5.0 up to and including 5.0.9
From 5.1 up to and including 5.1.5
From 5.2 up to and including 5.2.6
From 5.3 up to and including 5.3.3

Fixed in

3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2

What to do

If your site has an affected version, update WordPress to version 5.4.2 or newer.

Official ID

CVE-2020-4050

Report title

WordPress Core < 5.4.2 - Arbitrary User Meta Update

First reported

10 June 2020

Sources

Wordfence, seen 10 June 2020

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.33; from 3.8 up to and including 3.8.33; from 3.9 up to and including 3.9.31; from 4.0 up to and including 4.0.30; from 4.1 up to and including 4.1.30; from 4.2 up to and including 4.2.27; from 4.3 up to and including 4.3.23; from 4.4 up to and including 4.4.22; from 4.5 up to and including 4.5.21; from 4.6 up to and including 4.6.18; from 4.7 up to and including 4.7.17; from 4.8 up to and including 4.8.13; from 4.9 up to and including 4.9.14; from 5.0 up to and including 5.0.9; from 5.1 up to and including 5.1.5; from 5.2 up to and including 5.2.6; from 5.3 up to and including 5.3.3) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.33
From 3.8 up to and including 3.8.33
From 3.9 up to and including 3.9.31
From 4.0 up to and including 4.0.30
From 4.1 up to and including 4.1.30
From 4.2 up to and including 4.2.27
From 4.3 up to and including 4.3.23
From 4.4 up to and including 4.4.22
From 4.5 up to and including 4.5.21
From 4.6 up to and including 4.6.18
From 4.7 up to and including 4.7.17
From 4.8 up to and including 4.8.13
From 4.9 up to and including 4.9.14
From 5.0 up to and including 5.0.9
From 5.1 up to and including 5.1.5
From 5.2 up to and including 5.2.6
From 5.3 up to and including 5.3.3

Fixed in

3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2

What to do

If your site has an affected version, update WordPress to version 5.4.2 or newer.

Official ID

CVE-2020-4049

Report title

WordPress Core < 5.4.2 - Self-Cross Site Scripting via Theme Folder Name

First reported

10 June 2020

Sources

Wordfence, seen 10 June 2020

This week

Someone could send your visitors from your site to a harmful site (before 3.7; from 3.7 up to and including 3.7.33; from 3.8 up to and including 3.8.33; from 3.9 up to and including 3.9.31; from 4.0 up to and including 4.0.30; from 4.1 up to and including 4.1.30; from 4.2 up to and including 4.2.27; from 4.3 up to and including 4.3.23; from 4.4 up to and including 4.4.22; from 4.5 up to and including 4.5.21; from 4.6 up to and including 4.6.18; from 4.7 up to and including 4.7.17; from 4.8 up to and including 4.8.13; from 4.9 up to and including 4.9.14; from 5.0 up to and including 5.0.9; from 5.1 up to and including 5.1.5; from 5.2 up to and including 5.2.6; from 5.3 up to and including 5.3.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.33
From 3.8 up to and including 3.8.33
From 3.9 up to and including 3.9.31
From 4.0 up to and including 4.0.30
From 4.1 up to and including 4.1.30
From 4.2 up to and including 4.2.27
From 4.3 up to and including 4.3.23
From 4.4 up to and including 4.4.22
From 4.5 up to and including 4.5.21
From 4.6 up to and including 4.6.18
From 4.7 up to and including 4.7.17
From 4.8 up to and including 4.8.13
From 4.9 up to and including 4.9.14
From 5.0 up to and including 5.0.9
From 5.1 up to and including 5.1.5
From 5.2 up to and including 5.2.6
From 5.3 up to and including 5.3.3

Fixed in

3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2

What to do

If your site has an affected version, update WordPress to version 5.4.2 or newer.

Official ID

CVE-2020-4048

Report title

WordPress Core < 5.4.2 - Open Redirect

First reported

10 June 2020

Sources

Wordfence, seen 10 June 2020

This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.32; from 3.8 up to and including 3.8.32; from 3.9 up to and including 3.9.30; from 4.0 up to and including 4.0.29; from 4.1 up to and including 4.1.29; from 4.2 up to and including 4.2.26; from 4.3 up to and including 4.3.22; from 4.4 up to and including 4.4.21; from 4.5 up to and including 4.5.20; from 4.6 up to and including 4.6.17; from 4.7 up to and including 4.7.16; from 4.8 up to and including 4.8.12; from 4.9 up to and including 4.9.13; from 5.0 up to and including 5.0.8; from 5.1 up to and including 5.1.4; from 5.2 up to and including 5.2.5; from 5.3 up to and including 5.3.2; from 5.4 up to and including 5.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.32
From 3.8 up to and including 3.8.32
From 3.9 up to and including 3.9.30
From 4.0 up to and including 4.0.29
From 4.1 up to and including 4.1.29
From 4.2 up to and including 4.2.26
From 4.3 up to and including 4.3.22
From 4.4 up to and including 4.4.21
From 4.5 up to and including 4.5.20
From 4.6 up to and including 4.6.17
From 4.7 up to and including 4.7.16
From 4.8 up to and including 4.8.12
From 4.9 up to and including 4.9.13
From 5.0 up to and including 5.0.8
From 5.1 up to and including 5.1.4
From 5.2 up to and including 5.2.5
From 5.3 up to and including 5.3.2
From 5.4 up to and including 5.4

Fixed in

3.7.33, 3.8.33, 3.9.31, 4.0.30, 4.1.30, 4.2.27, 4.3.23, 4.4.22, 4.5.21, 4.6.18, 4.7.17, 4.8.13, 4.9.14, 5.0.9, 5.1.5, 5.2.6, 5.3.3, 5.4.1

What to do

If your site has an affected version, update WordPress to version 5.4.1 or newer.

Official ID

CVE-2020-11026

Report title

WordPress Core < 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads

First reported

29 April 2020

Sources

Wordfence, seen 29 April 2020

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.32; from 3.8 up to and including 3.8.32; from 3.9 up to and including 3.9.30; from 4.0 up to and including 4.0.29; from 4.1 up to and including 4.1.29; from 4.2 up to and including 4.2.26; from 4.3 up to and including 4.3.22; from 4.4 up to and including 4.4.21; from 4.5 up to and including 4.5.20; from 4.6 up to and including 4.6.17; from 4.7 up to and including 4.7.16; from 4.8 up to and including 4.8.12; from 4.9 up to and including 4.9.13; from 5.0 up to and including 5.0.8; from 5.1 up to and including 5.1.4; from 5.2 up to and including 5.2.5; from 5.3 up to and including 5.3.2; from 5.4 up to and including 5.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.32
From 3.8 up to and including 3.8.32
From 3.9 up to and including 3.9.30
From 4.0 up to and including 4.0.29
From 4.1 up to and including 4.1.29
From 4.2 up to and including 4.2.26
From 4.3 up to and including 4.3.22
From 4.4 up to and including 4.4.21
From 4.5 up to and including 4.5.20
From 4.6 up to and including 4.6.17
From 4.7 up to and including 4.7.16
From 4.8 up to and including 4.8.12
From 4.9 up to and including 4.9.13
From 5.0 up to and including 5.0.8
From 5.1 up to and including 5.1.4
From 5.2 up to and including 5.2.5
From 5.3 up to and including 5.3.2
From 5.4 up to and including 5.4

Fixed in

3.7.33, 3.8.33, 3.9.31, 4.0.30, 4.1.30, 4.2.27, 4.3.23, 4.4.22, 4.5.21, 4.6.18, 4.7.17, 4.8.13, 4.9.14, 5.0.9, 5.1.5, 5.2.6, 5.3.3, 5.4.1

What to do

If your site has an affected version, update WordPress to version 5.4.1 or newer.

Official ID

CVE-2020-11030

Report title

WordPress Core < 5.4.1 - Cross-Site Scripting in the Block Editor

First reported

29 April 2020

Sources

Wordfence, seen 29 April 2020

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.32; from 3.8 up to and including 3.8.32; from 3.9 up to and including 3.9.30; from 4.0 up to and including 4.0.29; from 4.1 up to and including 4.1.29; from 4.2 up to and including 4.2.26; from 4.3 up to and including 4.3.22; from 4.4 up to and including 4.4.21; from 4.5 up to and including 4.5.20; from 4.6 up to and including 4.6.17; from 4.7 up to and including 4.7.16; from 4.8 up to and including 4.8.12; from 4.9 up to and including 4.9.13; from 5.0 up to and including 5.0.8; from 5.1 up to and including 5.1.4; from 5.2 up to and including 5.2.5; from 5.3 up to and including 5.3.2; from 5.4 up to and including 5.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.32
From 3.8 up to and including 3.8.32
From 3.9 up to and including 3.9.30
From 4.0 up to and including 4.0.29
From 4.1 up to and including 4.1.29
From 4.2 up to and including 4.2.26
From 4.3 up to and including 4.3.22
From 4.4 up to and including 4.4.21
From 4.5 up to and including 4.5.20
From 4.6 up to and including 4.6.17
From 4.7 up to and including 4.7.16
From 4.8 up to and including 4.8.12
From 4.9 up to and including 4.9.13
From 5.0 up to and including 5.0.8
From 5.1 up to and including 5.1.4
From 5.2 up to and including 5.2.5
From 5.3 up to and including 5.3.2
From 5.4 up to and including 5.4

Fixed in

3.7.33, 3.8.33, 3.9.31, 4.0.30, 4.1.30, 4.2.27, 4.3.23, 4.4.22, 4.5.21, 4.6.18, 4.7.17, 4.8.13, 4.9.14, 5.0.9, 5.1.5, 5.2.6, 5.3.3, 5.4.1

What to do

If your site has an affected version, update WordPress to version 5.4.1 or newer.

Official ID

CVE-2020-11027

Report title

WordPress Core < 5.4.1 - Password Reset Link Non-Expiration

First reported

29 April 2020

Sources

Wordfence, seen 29 April 2020

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.32; from 3.8 up to and including 3.8.32; from 3.9 up to and including 3.9.30; from 4.0 up to and including 4.0.29; from 4.1 up to and including 4.1.29; from 4.2 up to and including 4.2.26; from 4.3 up to and including 4.3.22; from 4.4 up to and including 4.4.21; from 4.5 up to and including 4.5.20; from 4.6 up to and including 4.6.17; from 4.7 up to and including 4.7.16; from 4.8 up to and including 4.8.12; from 4.9 up to and including 4.9.13; from 5.0 up to and including 5.0.8; from 5.1 up to and including 5.1.4; from 5.2 up to and including 5.2.5; from 5.3 up to and including 5.3.2; from 5.4 up to and including 5.4) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.32
From 3.8 up to and including 3.8.32
From 3.9 up to and including 3.9.30
From 4.0 up to and including 4.0.29
From 4.1 up to and including 4.1.29
From 4.2 up to and including 4.2.26
From 4.3 up to and including 4.3.22
From 4.4 up to and including 4.4.21
From 4.5 up to and including 4.5.20
From 4.6 up to and including 4.6.17
From 4.7 up to and including 4.7.16
From 4.8 up to and including 4.8.12
From 4.9 up to and including 4.9.13
From 5.0 up to and including 5.0.8
From 5.1 up to and including 5.1.4
From 5.2 up to and including 5.2.5
From 5.3 up to and including 5.3.2
From 5.4 up to and including 5.4

Fixed in

3.7.33, 3.8.33, 3.9.31, 4.0.30, 4.1.30, 4.2.27, 4.3.23, 4.4.22, 4.5.21, 4.6.18, 4.7.17, 4.8.13, 4.9.14, 5.0.9, 5.1.5, 5.2.6, 5.3.3, 5.4.1

What to do

If your site has an affected version, update WordPress to version 5.4.1 or newer.

Official ID

CVE-2020-11029

Report title

WordPress Core < 5.4.1 - Reflected Cross Site Scripting

First reported

29 April 2020

Sources

Wordfence, seen 29 April 2020

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.32; from 3.8 up to and including 3.8.32; from 3.9 up to and including 3.9.30; from 4.0 up to and including 4.0.29; from 4.1 up to and including 4.1.29; from 4.2 up to and including 4.2.26; from 4.3 up to and including 4.3.22; from 4.4 up to and including 4.4.21; from 4.5 up to and including 4.5.20; from 4.6 up to and including 4.6.17; from 4.7 up to and including 4.7.16; from 4.8 up to and including 4.8.12; from 4.9 up to and including 4.9.13; from 5.0 up to and including 5.0.8; from 5.1 up to and including 5.1.4; from 5.2 up to and including 5.2.5; from 5.3 up to and including 5.3.2; from 5.4 up to and including 5.4) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.32
From 3.8 up to and including 3.8.32
From 3.9 up to and including 3.9.30
From 4.0 up to and including 4.0.29
From 4.1 up to and including 4.1.29
From 4.2 up to and including 4.2.26
From 4.3 up to and including 4.3.22
From 4.4 up to and including 4.4.21
From 4.5 up to and including 4.5.20
From 4.6 up to and including 4.6.17
From 4.7 up to and including 4.7.16
From 4.8 up to and including 4.8.12
From 4.9 up to and including 4.9.13
From 5.0 up to and including 5.0.8
From 5.1 up to and including 5.1.4
From 5.2 up to and including 5.2.5
From 5.3 up to and including 5.3.2
From 5.4 up to and including 5.4

Fixed in

3.7.33, 3.8.33, 3.9.31, 4.0.30, 4.1.30, 4.2.27, 4.3.23, 4.4.22, 4.5.21, 4.6.18, 4.7.17, 4.8.13, 4.9.14, 5.0.9, 5.1.5, 5.2.6, 5.3.3, 5.4.1

What to do

If your site has an affected version, update WordPress to version 5.4.1 or newer.

Official ID

CVE-2020-11025

Report title

WordPress Core < 5.4.1 - Authenticated Cross-Site Scripting via Customizer

First reported

29 April 2020

Sources

Wordfence, seen 29 April 2020

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.32; from 3.8 up to and including 3.8.32; from 3.9 up to and including 3.9.30; from 4.0 up to and including 4.0.29; from 4.1 up to and including 4.1.29; from 4.2 up to and including 4.2.26; from 4.3 up to and including 4.3.22; from 4.4 up to and including 4.4.21; from 4.5 up to and including 4.5.20; from 4.6 up to and including 4.6.17; from 4.7 up to and including 4.7.16; from 4.8 up to and including 4.8.12; from 4.9 up to and including 4.9.13; from 5.0 up to and including 5.0.8; from 5.1 up to and including 5.1.4; from 5.2 up to and including 5.2.5; from 5.3 up to and including 5.3.2; from 5.4 up to and including 5.4) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.32
From 3.8 up to and including 3.8.32
From 3.9 up to and including 3.9.30
From 4.0 up to and including 4.0.29
From 4.1 up to and including 4.1.29
From 4.2 up to and including 4.2.26
From 4.3 up to and including 4.3.22
From 4.4 up to and including 4.4.21
From 4.5 up to and including 4.5.20
From 4.6 up to and including 4.6.17
From 4.7 up to and including 4.7.16
From 4.8 up to and including 4.8.12
From 4.9 up to and including 4.9.13
From 5.0 up to and including 5.0.8
From 5.1 up to and including 5.1.4
From 5.2 up to and including 5.2.5
From 5.3 up to and including 5.3.2
From 5.4 up to and including 5.4

Fixed in

3.7.33, 3.8.33, 3.9.31, 4.0.30, 4.1.30, 4.2.27, 4.3.23, 4.4.22, 4.5.21, 4.6.18, 4.7.17, 4.8.13, 4.9.14, 5.0.9, 5.1.5, 5.2.6, 5.3.3, 5.4.1

What to do

If your site has an affected version, update WordPress to version 5.4.1 or newer.

Official ID

CVE-2020-11028

Report title

WordPress Core < 5.4.1 - Private Post Disclosure

First reported

29 April 2020

Sources

Wordfence, seen 29 April 2020

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.31; from 3.8 up to and including 3.8.31; from 3.9 up to and including 3.9.29; from 4.0 up to and including 4.0.28; from 4.1 up to and including 4.1.28; from 4.2 up to and including 4.2.25; from 4.3 up to and including 4.3.21; from 4.4 up to and including 4.4.20; from 4.5 up to and including 4.5.19; from 4.6 up to and including 4.6.16; from 4.7 up to and including 4.7.15; from 4.8 up to and including 4.8.11; from 4.9 up to and including 4.9.12; from 5.0 up to and including 5.0.7; from 5.1 up to and including 5.1.3; from 5.2 up to and including 5.2.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.31
From 3.8 up to and including 3.8.31
From 3.9 up to and including 3.9.29
From 4.0 up to and including 4.0.28
From 4.1 up to and including 4.1.28
From 4.2 up to and including 4.2.25
From 4.3 up to and including 4.3.21
From 4.4 up to and including 4.4.20
From 4.5 up to and including 4.5.19
From 4.6 up to and including 4.6.16
From 4.7 up to and including 4.7.15
From 4.8 up to and including 4.8.11
From 4.9 up to and including 4.9.12
From 5.0 up to and including 5.0.7
From 5.1 up to and including 5.1.3
From 5.2 up to and including 5.2.4

Fixed in

3.7.32, 3.8.32, 3.9.30, 4.0.29, 4.1.29, 4.2.26, 4.3.22, 4.4.21, 4.5.20, 4.6.17, 4.7.16, 4.8.12, 4.9.13, 5.0.8, 5.1.4, 5.2.5, 5.3.1

What to do

If your site has an affected version, update WordPress to version 5.3.1 or newer.

Official ID

CVE-2019-16781

Report title

WordPress Core < 5.3.1 - Authenticated Stored Cross-Site Scripting

First reported

13 December 2019

Sources

Wordfence, seen 13 December 2019

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.31; from 3.8 up to and including 3.8.31; from 3.9 up to and including 3.9.29; from 4.0 up to and including 4.0.28; from 4.1 up to and including 4.1.28; from 4.2 up to and including 4.2.25; from 4.3 up to and including 4.3.21; from 4.4 up to and including 4.4.20; from 4.5 up to and including 4.5.19; from 4.6 up to and including 4.6.16; from 4.7 up to and including 4.7.15; from 4.8 up to and including 4.8.11; from 4.9 up to and including 4.9.12; from 5.0 up to and including 5.0.7; from 5.1 up to and including 5.1.3; from 5.2 up to and including 5.2.4; from 5.3 up to and including 5.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.31
From 3.8 up to and including 3.8.31
From 3.9 up to and including 3.9.29
From 4.0 up to and including 4.0.28
From 4.1 up to and including 4.1.28
From 4.2 up to and including 4.2.25
From 4.3 up to and including 4.3.21
From 4.4 up to and including 4.4.20
From 4.5 up to and including 4.5.19
From 4.6 up to and including 4.6.16
From 4.7 up to and including 4.7.15
From 4.8 up to and including 4.8.11
From 4.9 up to and including 4.9.12
From 5.0 up to and including 5.0.7
From 5.1 up to and including 5.1.3
From 5.2 up to and including 5.2.4
From 5.3 up to and including 5.3

Fixed in

3.7.32, 3.8.32, 3.9.30, 4.0.29, 4.1.29, 4.2.26, 4.3.22, 4.4.21, 4.5.20, 4.6.17, 4.7.16, 4.8.12, 4.9.13, 5.0.8, 5.1.4, 5.2.5, 5.3.1

What to do

If your site has an affected version, update WordPress to version 5.3.1 or newer.

Official ID

CVE-2019-20041

Report title

WordPress Core < 5.3.1 - Authenticated Stored Cross-Site Scripting

First reported

13 December 2019

Sources

Wordfence, seen 13 December 2019

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.31; from 3.8 up to and including 3.8.31; from 3.9 up to and including 3.9.29; from 4.0 up to and including 4.0.28; from 4.1 up to and including 4.1.28; from 4.2 up to and including 4.2.25; from 4.3 up to and including 4.3.21; from 4.4 up to and including 4.4.20; from 4.5 up to and including 4.5.19; from 4.6 up to and including 4.6.16; from 4.7 up to and including 4.7.15; from 4.8 up to and including 4.8.11; from 4.9 up to and including 4.9.12; from 5.0 up to and including 5.0.7; from 5.1 up to and including 5.1.3; from 5.2 up to and including 5.2.4; from 5.3 up to and including 5.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.31
From 3.8 up to and including 3.8.31
From 3.9 up to and including 3.9.29
From 4.0 up to and including 4.0.28
From 4.1 up to and including 4.1.28
From 4.2 up to and including 4.2.25
From 4.3 up to and including 4.3.21
From 4.4 up to and including 4.4.20
From 4.5 up to and including 4.5.19
From 4.6 up to and including 4.6.16
From 4.7 up to and including 4.7.15
From 4.8 up to and including 4.8.11
From 4.9 up to and including 4.9.12
From 5.0 up to and including 5.0.7
From 5.1 up to and including 5.1.3
From 5.2 up to and including 5.2.4
From 5.3 up to and including 5.3

Fixed in

3.7.32, 3.8.32, 3.9.30, 4.0.29, 4.1.29, 4.2.26, 4.3.22, 4.4.21, 4.5.20, 4.6.17, 4.7.16, 4.8.12, 4.9.13, 5.0.8, 5.1.4, 5.2.5, 5.3.1

What to do

If your site has an affected version, update WordPress to version 5.3.1 or newer.

Official ID

CVE-2019-16780

Report title

WordPress Core < 5.3.1 - Stored Cross-Site Scripting via Block Editor

First reported

13 December 2019

Sources

Wordfence, seen 13 December 2019

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.31; from 3.8 up to and including 3.8.31; from 3.9 up to and including 3.9.29; from 4.0 up to and including 4.0.28; from 4.1 up to and including 4.1.28; from 4.2 up to and including 4.2.25; from 4.3 up to and including 4.3.21; from 4.4 up to and including 4.4.20; from 4.5 up to and including 4.5.19; from 4.6 up to and including 4.6.16; from 4.7 up to and including 4.7.15; from 4.8 up to and including 4.8.11; from 4.9 up to and including 4.9.12; from 5.0 up to and including 5.0.7; from 5.1 up to and including 5.1.3; from 5.2 up to and including 5.2.4; from 5.3 up to and including 5.3) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.31
From 3.8 up to and including 3.8.31
From 3.9 up to and including 3.9.29
From 4.0 up to and including 4.0.28
From 4.1 up to and including 4.1.28
From 4.2 up to and including 4.2.25
From 4.3 up to and including 4.3.21
From 4.4 up to and including 4.4.20
From 4.5 up to and including 4.5.19
From 4.6 up to and including 4.6.16
From 4.7 up to and including 4.7.15
From 4.8 up to and including 4.8.11
From 4.9 up to and including 4.9.12
From 5.0 up to and including 5.0.7
From 5.1 up to and including 5.1.3
From 5.2 up to and including 5.2.4
From 5.3 up to and including 5.3

Fixed in

3.7.32, 3.8.32, 3.9.30, 4.0.29, 4.1.29, 4.2.26, 4.3.22, 4.4.21, 4.5.20, 4.6.17, 4.7.16, 4.8.12, 4.9.13, 5.0.8, 5.1.4, 5.2.5, 5.3.1

What to do

If your site has an affected version, update WordPress to version 5.3.1 or newer.

Official ID

CVE-2019-20042

Report title

WordPress Core < 5.3.1 - Authenticated Stored Cross-Site Scripting

First reported

13 December 2019

Sources

Wordfence, seen 13 December 2019

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.31; from 3.8 up to and including 3.8.31; from 3.9 up to and including 3.9.29; from 4.0 up to and including 4.0.28; from 4.1 up to and including 4.1.28; from 4.2 up to and including 4.2.25; from 4.3 up to and including 4.3.21; from 4.4 up to and including 4.4.20; from 4.5 up to and including 4.5.19; from 4.6 up to and including 4.6.16; from 4.7 up to and including 4.7.15; from 4.8 up to and including 4.8.11; from 4.9 up to and including 4.9.12; from 5.0 up to and including 5.0.7; from 5.1 up to and including 5.1.3; from 5.2 up to and including 5.2.4; from 5.3 up to and including 5.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.31
From 3.8 up to and including 3.8.31
From 3.9 up to and including 3.9.29
From 4.0 up to and including 4.0.28
From 4.1 up to and including 4.1.28
From 4.2 up to and including 4.2.25
From 4.3 up to and including 4.3.21
From 4.4 up to and including 4.4.20
From 4.5 up to and including 4.5.19
From 4.6 up to and including 4.6.16
From 4.7 up to and including 4.7.15
From 4.8 up to and including 4.8.11
From 4.9 up to and including 4.9.12
From 5.0 up to and including 5.0.7
From 5.1 up to and including 5.1.3
From 5.2 up to and including 5.2.4
From 5.3 up to and including 5.3

Fixed in

3.7.32, 3.8.32, 3.9.30, 4.0.29, 4.1.29, 4.2.26, 4.3.22, 4.4.21, 4.5.20, 4.6.17, 4.7.16, 4.8.12, 4.9.13, 5.0.8, 5.1.4, 5.2.5, 5.3.1

What to do

If your site has an affected version, update WordPress to version 5.3.1 or newer.

Official ID

CVE-2019-20043

Report title

WordPress Core < 5.3.1 - Authorization Bypass

First reported

1 December 2019

Sources

Wordfence, seen 1 December 2019

This week

Someone could use it to harm your site (up to and including 3.6.1; from 3.7 up to and including 3.7.30; from 3.8 up to and including 3.8.30; from 3.9 up to and including 3.9.28; from 4.0 up to and including 4.0.27; from 4.1 up to and including 4.1.27; from 4.2 up to and including 4.2.24; from 4.3 up to and including 4.3.20; from 4.4 up to and including 4.4.19; from 4.5 up to and including 4.5.18; from 4.6 up to and including 4.6.15; from 4.7 up to and including 4.7.13; from 4.8 up to and including 4.8.10; from 4.9 up to and including 4.9.11; from 5.0 up to and including 5.0.6; from 5.1 up to and including 5.1.2; from 5.2 up to and including 5.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.30
From 3.8 up to and including 3.8.30
From 3.9 up to and including 3.9.28
From 4.0 up to and including 4.0.27
From 4.1 up to and including 4.1.27
From 4.2 up to and including 4.2.24
From 4.3 up to and including 4.3.20
From 4.4 up to and including 4.4.19
From 4.5 up to and including 4.5.18
From 4.6 up to and including 4.6.15
From 4.7 up to and including 4.7.13
From 4.8 up to and including 4.8.10
From 4.9 up to and including 4.9.11
From 5.0 up to and including 5.0.6
From 5.1 up to and including 5.1.2
From 5.2 up to and including 5.2.3

Fixed in

3.7.31, 3.8.31, 3.9.29, 4.0.28, 4.1.28, 4.2.25, 4.3.21, 4.4.20, 4.5.19, 4.6.16, 4.7.14, 4.8.11, 4.9.12, 5.0.7, 5.1.3, 5.2.4

What to do

If your site has an affected version, update WordPress to version 5.2.4 or newer.

Official ID

CVE-2019-17675

Report title

WordPress Core < 5.2.4 - Type Confusion

First reported

14 October 2019

Sources

Wordfence, seen 14 October 2019

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.30; from 3.8 up to and including 3.8.30; from 3.9 up to and including 3.9.28; from 4.0 up to and including 4.0.27; from 4.1 up to and including 4.1.27; from 4.2 up to and including 4.2.24; from 4.3 up to and including 4.3.20; from 4.4 up to and including 4.4.19; from 4.5 up to and including 4.5.18; from 4.6 up to and including 4.6.15; from 4.7 up to and including 4.7.14; from 4.8 up to and including 4.8.10; from 4.9 up to and including 4.9.11; from 5.0 up to and including 5.0.6; from 5.1 up to and including 5.1.2; from 5.2 up to and including 5.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.30
From 3.8 up to and including 3.8.30
From 3.9 up to and including 3.9.28
From 4.0 up to and including 4.0.27
From 4.1 up to and including 4.1.27
From 4.2 up to and including 4.2.24
From 4.3 up to and including 4.3.20
From 4.4 up to and including 4.4.19
From 4.5 up to and including 4.5.18
From 4.6 up to and including 4.6.15
From 4.7 up to and including 4.7.14
From 4.8 up to and including 4.8.10
From 4.9 up to and including 4.9.11
From 5.0 up to and including 5.0.6
From 5.1 up to and including 5.1.2
From 5.2 up to and including 5.2.3

Fixed in

3.7.31, 3.8.31, 3.9.29, 4.0.28, 4.1.28, 4.2.25, 4.3.21, 4.4.20, 4.5.19, 4.6.16, 4.7.15, 4.8.11, 4.9.12, 5.0.7, 5.1.3, 5.2.4

What to do

If your site has an affected version, update WordPress to version 5.2.4 or newer.

Official ID

CVE-2019-17673

Report title

WordPress Core < 5.2.4 - Cache Poisoning

First reported

14 October 2019

Sources

Wordfence, seen 14 October 2019

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.30; from 3.8 up to and including 3.8.30; from 3.9 up to and including 3.9.28; from 4.0 up to and including 4.0.27; from 4.1 up to and including 4.1.27; from 4.2 up to and including 4.2.24; from 4.3 up to and including 4.3.20; from 4.4 up to and including 4.4.19; from 4.5 up to and including 4.5.18; from 4.6 up to and including 4.6.15; from 4.7 up to and including 4.7.14; from 4.8 up to and including 4.8.10; from 4.9 up to and including 4.9.11; from 5.0 up to and including 5.0.6; from 5.1 up to and including 5.1.2; from 5.2 up to and including 5.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.30
From 3.8 up to and including 3.8.30
From 3.9 up to and including 3.9.28
From 4.0 up to and including 4.0.27
From 4.1 up to and including 4.1.27
From 4.2 up to and including 4.2.24
From 4.3 up to and including 4.3.20
From 4.4 up to and including 4.4.19
From 4.5 up to and including 4.5.18
From 4.6 up to and including 4.6.15
From 4.7 up to and including 4.7.14
From 4.8 up to and including 4.8.10
From 4.9 up to and including 4.9.11
From 5.0 up to and including 5.0.6
From 5.1 up to and including 5.1.2
From 5.2 up to and including 5.2.3

Fixed in

3.7.31, 3.8.31, 3.9.29, 4.0.28, 4.1.28, 4.2.25, 4.3.21, 4.4.20, 4.5.19, 4.6.16, 4.7.15, 4.8.11, 4.9.12, 5.0.7, 5.1.3, 5.2.4

What to do

If your site has an affected version, update WordPress to version 5.2.4 or newer.

Official ID

CVE-2019-17674

Report title

WordPress Core < 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer

First reported

14 October 2019

Sources

Wordfence, seen 14 October 2019

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.30; from 3.8 up to and including 3.8.30; from 3.9 up to and including 3.9.28; from 4.0 up to and including 4.0.27; from 4.1 up to and including 4.1.27; from 4.2 up to and including 4.2.24; from 4.3 up to and including 4.3.20; from 4.4 up to and including 4.4.19; from 4.5 up to and including 4.5.18; from 4.6 up to and including 4.6.15; from 4.7 up to and including 4.7.14; from 4.8 up to and including 4.8.10; from 4.9 up to and including 4.9.11; from 5.0 up to and including 5.0.6; from 5.1 up to and including 5.1.2; from 5.2 up to and including 5.2.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.30
From 3.8 up to and including 3.8.30
From 3.9 up to and including 3.9.28
From 4.0 up to and including 4.0.27
From 4.1 up to and including 4.1.27
From 4.2 up to and including 4.2.24
From 4.3 up to and including 4.3.20
From 4.4 up to and including 4.4.19
From 4.5 up to and including 4.5.18
From 4.6 up to and including 4.6.15
From 4.7 up to and including 4.7.14
From 4.8 up to and including 4.8.10
From 4.9 up to and including 4.9.11
From 5.0 up to and including 5.0.6
From 5.1 up to and including 5.1.2
From 5.2 up to and including 5.2.3

Fixed in

3.7.31, 3.8.31, 3.9.29, 4.0.28, 4.1.28, 4.2.25, 4.3.21, 4.4.20, 4.5.19, 4.6.16, 4.7.15, 4.8.11, 4.9.12, 5.0.7, 5.1.3, 5.2.4

What to do

If your site has an affected version, update WordPress to version 5.2.4 or newer.

Official ID

CVE-2019-17671

Report title

WordPress Core < 5.2.4 - Authorization Bypass

First reported

14 October 2019

Sources

Wordfence, seen 14 October 2019

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.30; from 3.8 up to and including 3.8.30; from 3.9 up to and including 3.9.28; from 4.0 up to and including 4.0.27; from 4.1 up to and including 4.1.27; from 4.2 up to and including 4.2.24; from 4.3 up to and including 4.3.20; from 4.4 up to and including 4.4.19; from 4.5 up to and including 4.5.18; from 4.6 up to and including 4.6.15; from 4.7 up to and including 4.7.13; from 4.8 up to and including 4.8.10; from 4.9 up to and including 4.9.11; from 5.0 up to and including 5.0.6; from 5.1 up to and including 5.1.2; from 5.2 up to and including 5.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.30
From 3.8 up to and including 3.8.30
From 3.9 up to and including 3.9.28
From 4.0 up to and including 4.0.27
From 4.1 up to and including 4.1.27
From 4.2 up to and including 4.2.24
From 4.3 up to and including 4.3.20
From 4.4 up to and including 4.4.19
From 4.5 up to and including 4.5.18
From 4.6 up to and including 4.6.15
From 4.7 up to and including 4.7.13
From 4.8 up to and including 4.8.10
From 4.9 up to and including 4.9.11
From 5.0 up to and including 5.0.6
From 5.1 up to and including 5.1.2
From 5.2 up to and including 5.2.3

Fixed in

3.7.31, 3.8.31, 3.9.29, 4.0.28, 4.1.28, 4.2.25, 4.3.21, 4.4.20, 4.5.19, 4.6.16, 4.7.14, 4.8.11, 4.9.12, 5.0.7, 5.1.3, 5.2.4

What to do

If your site has an affected version, update WordPress to version 5.2.4 or newer.

Official ID

CVE-2019-17669

Report title

WordPress Core < 5.2.4 - Server Side Request Forgery

First reported

14 October 2019

Sources

Wordfence, seen 14 October 2019

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.30; from 3.8 up to and including 3.8.30; from 3.9 up to and including 3.9.28; from 4.0 up to and including 4.0.27; from 4.1 up to and including 4.1.27; from 4.2 up to and including 4.2.24; from 4.3 up to and including 4.3.20; from 4.4 up to and including 4.4.19; from 4.5 up to and including 4.5.18; from 4.6 up to and including 4.6.15; from 4.7 up to and including 4.7.13; from 4.8 up to and including 4.8.10; from 4.9 up to and including 4.9.11; from 5.0 up to and including 5.0.6; from 5.1 up to and including 5.1.2; from 5.2 up to and including 5.2.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.30
From 3.8 up to and including 3.8.30
From 3.9 up to and including 3.9.28
From 4.0 up to and including 4.0.27
From 4.1 up to and including 4.1.27
From 4.2 up to and including 4.2.24
From 4.3 up to and including 4.3.20
From 4.4 up to and including 4.4.19
From 4.5 up to and including 4.5.18
From 4.6 up to and including 4.6.15
From 4.7 up to and including 4.7.13
From 4.8 up to and including 4.8.10
From 4.9 up to and including 4.9.11
From 5.0 up to and including 5.0.6
From 5.1 up to and including 5.1.2
From 5.2 up to and including 5.2.3

Fixed in

3.7.31, 3.8.31, 3.9.29, 4.0.28, 4.1.28, 4.2.25, 4.3.21, 4.4.20, 4.5.19, 4.6.16, 4.7.14, 4.8.11, 4.9.12, 5.0.7, 5.1.3, 5.2.4

What to do

If your site has an affected version, update WordPress to version 5.2.4 or newer.

Official ID

CVE-2019-17670

Report title

WordPress Core < 5.2.4 - Server Side Request Forgery #2

First reported

14 October 2019

Sources

Wordfence, seen 14 October 2019

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.30; from 3.8 up to and including 3.8.30; from 3.9 up to and including 3.9.28; from 4.0 up to and including 4.0.27; from 4.1 up to and including 4.1.27; from 4.2 up to and including 4.2.24; from 4.3 up to and including 4.3.20; from 4.4 up to and including 4.4.19; from 4.5 up to and including 4.5.18; from 4.6 up to and including 4.6.15; from 4.7 up to and including 4.7.13; from 4.7 up to and including 4.7.14; from 4.8 up to and including 4.8.10; from 4.9 up to and including 4.9.11; from 5.0 up to and including 5.0.6; from 5.1 up to and including 5.1.2; from 5.2 up to and including 5.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.30
From 3.8 up to and including 3.8.30
From 3.9 up to and including 3.9.28
From 4.0 up to and including 4.0.27
From 4.1 up to and including 4.1.27
From 4.2 up to and including 4.2.24
From 4.3 up to and including 4.3.20
From 4.4 up to and including 4.4.19
From 4.5 up to and including 4.5.18
From 4.6 up to and including 4.6.15
From 4.7 up to and including 4.7.13
From 4.7 up to and including 4.7.14
From 4.8 up to and including 4.8.10
From 4.9 up to and including 4.9.11
From 5.0 up to and including 5.0.6
From 5.1 up to and including 5.1.2
From 5.2 up to and including 5.2.3

Fixed in

3.7.31, 3.8.31, 3.9.29, 4.0.28, 4.1.28, 4.2.25, 4.3.21, 4.4.20, 4.5.19, 4.6.16, 4.7.15, 4.8.11, 4.9.12, 5.0.7, 5.1.3, 5.2.4

What to do

If your site has an affected version, update WordPress to version 5.2.4 or newer.

Official ID

CVE-2019-17672

Report title

WordPress Core < 5.2.4 - Authenticated Stored Cross-Site Scripting

First reported

14 October 2019

Sources

Wordfence, seen 14 October 2019

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.29; from 3.8 up to and including 3.8.29; from 3.9 up to and including 3.9.27; from 4.0 up to and including 4.0.26; from 4.1 up to and including 4.1.26; from 4.2 up to and including 4.2.23; from 4.3 up to and including 4.3.19; from 4.4 up to and including 4.4.18; from 4.5 up to and including 4.5.17; from 4.6 up to and including 4.6.13; from 4.7 up to and including 4.7.13; from 4.8 up to and including 4.8.9; from 4.9 up to and including 4.9.10; from 5.0 up to and including 5.0.5; from 5.1 up to and including 5.1.1; from 5.2 up to and including 5.2.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.29
From 3.8 up to and including 3.8.29
From 3.9 up to and including 3.9.27
From 4.0 up to and including 4.0.26
From 4.1 up to and including 4.1.26
From 4.2 up to and including 4.2.23
From 4.3 up to and including 4.3.19
From 4.4 up to and including 4.4.18
From 4.5 up to and including 4.5.17
From 4.6 up to and including 4.6.13
From 4.7 up to and including 4.7.13
From 4.8 up to and including 4.8.9
From 4.9 up to and including 4.9.10
From 5.0 up to and including 5.0.5
From 5.1 up to and including 5.1.1
From 5.2 up to and including 5.2.2

Fixed in

3.7.30, 3.8.30, 3.9.28, 4.0.27, 4.1.27, 4.2.24, 4.3.20, 4.4.19, 4.5.18, 4.6.15, 4.7.14, 4.8.10, 4.9.11, 5.0.6, 5.1.2, 5.2.3

What to do

If your site has an affected version, update WordPress to version 5.2.3 or newer.

Official ID

CVE-2019-16217

Report title

WordPress Core < 5.2.3 - Cross-Site Scripting via Media Uploads

First reported

5 September 2019

Sources

Wordfence, seen 5 September 2019

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.29; from 3.8 up to and including 3.8.29; from 3.9 up to and including 3.9.27; from 4.0 up to and including 4.0.26; from 4.1 up to and including 4.1.26; from 4.2 up to and including 4.2.23; from 4.3 up to and including 4.3.19; from 4.4 up to and including 4.4.18; from 4.5 up to and including 4.5.17; from 4.6 up to and including 4.6.13; from 4.7 up to and including 4.7.13; from 4.8 up to and including 4.8.9; from 4.9 up to and including 4.9.10; from 5.0 up to and including 5.0.5; from 5.1 up to and including 5.1.1; from 5.2 up to and including 5.2.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.29
From 3.8 up to and including 3.8.29
From 3.9 up to and including 3.9.27
From 4.0 up to and including 4.0.26
From 4.1 up to and including 4.1.26
From 4.2 up to and including 4.2.23
From 4.3 up to and including 4.3.19
From 4.4 up to and including 4.4.18
From 4.5 up to and including 4.5.17
From 4.6 up to and including 4.6.13
From 4.7 up to and including 4.7.13
From 4.8 up to and including 4.8.9
From 4.9 up to and including 4.9.10
From 5.0 up to and including 5.0.5
From 5.1 up to and including 5.1.1
From 5.2 up to and including 5.2.2

Fixed in

3.7.30, 3.8.30, 3.9.28, 4.0.27, 4.1.27, 4.2.24, 4.3.20, 4.4.19, 4.5.18, 4.6.15, 4.7.14, 4.8.10, 4.9.11, 5.0.6, 5.1.2, 5.2.3

What to do

If your site has an affected version, update WordPress to version 5.2.3 or newer.

Official ID

CVE-2019-16221

Report title

WordPress Core < 5.2.3 - Reflected Cross-Site Scripting

First reported

5 September 2019

Sources

Wordfence, seen 5 September 2019

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.29; from 3.8 up to and including 3.8.29; from 3.9 up to and including 3.9.27; from 4.0 up to and including 4.0.26; from 4.1 up to and including 4.1.26; from 4.2 up to and including 4.2.23; from 4.3 up to and including 4.3.19; from 4.4 up to and including 4.4.18; from 4.5 up to and including 4.5.17; from 4.6 up to and including 4.6.13; from 4.7 up to and including 4.7.13; from 4.8 up to and including 4.8.9; from 4.9 up to and including 4.9.10; from 5.0 up to and including 5.0.5; from 5.1 up to and including 5.1.1; from 5.2 up to and including 5.2.2) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.29
From 3.8 up to and including 3.8.29
From 3.9 up to and including 3.9.27
From 4.0 up to and including 4.0.26
From 4.1 up to and including 4.1.26
From 4.2 up to and including 4.2.23
From 4.3 up to and including 4.3.19
From 4.4 up to and including 4.4.18
From 4.5 up to and including 4.5.17
From 4.6 up to and including 4.6.13
From 4.7 up to and including 4.7.13
From 4.8 up to and including 4.8.9
From 4.9 up to and including 4.9.10
From 5.0 up to and including 5.0.5
From 5.1 up to and including 5.1.1
From 5.2 up to and including 5.2.2

Fixed in

3.7.30, 3.8.30, 3.9.28, 4.0.27, 4.1.27, 4.2.24, 4.3.20, 4.4.19, 4.5.18, 4.6.15, 4.7.14, 4.8.10, 4.9.11, 5.0.6, 5.1.2, 5.2.3

What to do

If your site has an affected version, update WordPress to version 5.2.3 or newer.

Official ID

CVE-2019-16222

Report title

WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments via URLs

First reported

5 September 2019

Sources

Wordfence, seen 5 September 2019

This week

Someone could send your visitors from your site to a harmful site (before 3.7; from 3.7 up to and including 3.7.29; from 3.8 up to and including 3.8.29; from 3.9 up to and including 3.9.27; from 4.0 up to and including 4.0.26; from 4.1 up to and including 4.1.26; from 4.2 up to and including 4.2.23; from 4.3 up to and including 4.3.19; from 4.4 up to and including 4.4.18; from 4.5 up to and including 4.5.17; from 4.6 up to and including 4.6.13; from 4.7 up to and including 4.7.13; from 4.8 up to and including 4.8.9; from 4.9 up to and including 4.9.10; from 5.0 up to and including 5.0.5; from 5.1 up to and including 5.1.1; from 5.2 up to and including 5.2.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.29
From 3.8 up to and including 3.8.29
From 3.9 up to and including 3.9.27
From 4.0 up to and including 4.0.26
From 4.1 up to and including 4.1.26
From 4.2 up to and including 4.2.23
From 4.3 up to and including 4.3.19
From 4.4 up to and including 4.4.18
From 4.5 up to and including 4.5.17
From 4.6 up to and including 4.6.13
From 4.7 up to and including 4.7.13
From 4.8 up to and including 4.8.9
From 4.9 up to and including 4.9.10
From 5.0 up to and including 5.0.5
From 5.1 up to and including 5.1.1
From 5.2 up to and including 5.2.2

Fixed in

3.7.30, 3.8.30, 3.9.28, 4.0.27, 4.1.27, 4.2.24, 4.3.20, 4.4.19, 4.5.18, 4.6.15, 4.7.14, 4.8.10, 4.9.11, 5.0.6, 5.1.2, 5.2.3

What to do

If your site has an affected version, update WordPress to version 5.2.3 or newer.

Official ID

CVE-2019-16220

Report title

WordPress Core < 5.2.3 - Open Redirect

First reported

5 September 2019

Sources

Wordfence, seen 5 September 2019

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.29; from 3.8 up to and including 3.8.29; from 3.9 up to and including 3.9.27; from 4.0 up to and including 4.0.26; from 4.1 up to and including 4.1.26; from 4.2 up to and including 4.2.23; from 4.3 up to and including 4.3.19; from 4.4 up to and including 4.4.18; from 4.5 up to and including 4.5.17; from 4.6 up to and including 4.6.13; from 4.7 up to and including 4.7.13; from 4.8 up to and including 4.8.9; from 4.9 up to and including 4.9.10; from 5.0 up to and including 5.0.5; from 5.1 up to and including 5.1.1; from 5.2 up to and including 5.2.2) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.29
From 3.8 up to and including 3.8.29
From 3.9 up to and including 3.9.27
From 4.0 up to and including 4.0.26
From 4.1 up to and including 4.1.26
From 4.2 up to and including 4.2.23
From 4.3 up to and including 4.3.19
From 4.4 up to and including 4.4.18
From 4.5 up to and including 4.5.17
From 4.6 up to and including 4.6.13
From 4.7 up to and including 4.7.13
From 4.8 up to and including 4.8.9
From 4.9 up to and including 4.9.10
From 5.0 up to and including 5.0.5
From 5.1 up to and including 5.1.1
From 5.2 up to and including 5.2.2

Fixed in

3.7.30, 3.8.30, 3.9.28, 4.0.27, 4.1.27, 4.2.24, 4.3.20, 4.4.19, 4.5.18, 4.6.15, 4.7.14, 4.8.10, 4.9.11, 5.0.6, 5.1.2, 5.2.3

What to do

If your site has an affected version, update WordPress to version 5.2.3 or newer.

Official ID

CVE-2019-16223

Report title

WordPress Core < 5.2.3 - Authenticated Cross-Site Scripting via Post Previews

First reported

5 September 2019

Sources

Wordfence, seen 5 September 2019

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.29; from 3.8 up to and including 3.8.29; from 3.9 up to and including 3.9.27; from 4.0 up to and including 4.0.26; from 4.1 up to and including 4.1.26; from 4.2 up to and including 4.2.23; from 4.3 up to and including 4.3.19; from 4.4 up to and including 4.4.18; from 4.5 up to and including 4.5.17; from 4.6 up to and including 4.6.13; from 4.7 up to and including 4.7.12; from 4.8 up to and including 4.8.9; from 4.9 up to and including 4.9.10; from 5.0 up to and including 5.0.5; from 5.1 up to and including 5.1.1; from 5.2 up to and including 5.2.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.29
From 3.8 up to and including 3.8.29
From 3.9 up to and including 3.9.27
From 4.0 up to and including 4.0.26
From 4.1 up to and including 4.1.26
From 4.2 up to and including 4.2.23
From 4.3 up to and including 4.3.19
From 4.4 up to and including 4.4.18
From 4.5 up to and including 4.5.17
From 4.6 up to and including 4.6.13
From 4.7 up to and including 4.7.12
From 4.8 up to and including 4.8.9
From 4.9 up to and including 4.9.10
From 5.0 up to and including 5.0.5
From 5.1 up to and including 5.1.1
From 5.2 up to and including 5.2.2

Fixed in

3.7.30, 3.8.30, 3.9.28, 4.0.27, 4.1.27, 4.2.24, 4.3.20, 4.4.19, 4.5.18, 4.6.15, 4.7.13, 4.8.10, 4.9.11, 5.0.6, 5.1.2, 5.2.3

What to do

If your site has an affected version, update WordPress to version 5.2.3 or newer.

Official ID

CVE-2019-16218

Report title

WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments

First reported

5 September 2019

Sources

Wordfence, seen 5 September 2019

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.29; from 3.8 up to and including 3.8.29; from 3.9 up to and including 3.9.27; from 4.0 up to and including 4.0.26; from 4.1 up to and including 4.1.26; from 4.2 up to and including 4.2.23; from 4.3 up to and including 4.3.19; from 4.4 up to and including 4.4.18; from 4.5 up to and including 4.5.17; from 4.6 up to and including 4.6.13; from 4.7 up to and including 4.7.12; from 4.8 up to and including 4.8.9; from 4.9 up to and including 4.9.10; from 5.0 up to and including 5.0.5; from 5.1 up to and including 5.1.1; from 5.2 up to and including 5.2.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.29
From 3.8 up to and including 3.8.29
From 3.9 up to and including 3.9.27
From 4.0 up to and including 4.0.26
From 4.1 up to and including 4.1.26
From 4.2 up to and including 4.2.23
From 4.3 up to and including 4.3.19
From 4.4 up to and including 4.4.18
From 4.5 up to and including 4.5.17
From 4.6 up to and including 4.6.13
From 4.7 up to and including 4.7.12
From 4.8 up to and including 4.8.9
From 4.9 up to and including 4.9.10
From 5.0 up to and including 5.0.5
From 5.1 up to and including 5.1.1
From 5.2 up to and including 5.2.2

Fixed in

3.7.30, 3.8.30, 3.9.28, 4.0.27, 4.1.27, 4.2.24, 4.3.20, 4.4.19, 4.5.18, 4.6.15, 4.7.13, 4.8.10, 4.9.11, 5.0.6, 5.1.2, 5.2.3

What to do

If your site has an affected version, update WordPress to version 5.2.3 or newer.

Official ID

CVE-2019-16219

Report title

WordPress Core < 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews

First reported

5 September 2019

Sources

Wordfence, seen 5 September 2019

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.28; from 3.8 up to and including 3.8.28; from 3.9 up to and including 3.9.26; from 4.0 up to and including 4.0.25; from 4.1 up to and including 4.1.25; from 4.2 up to and including 4.2.22; from 4.3 up to and including 4.3.18; from 4.4 up to and including 4.4.17; from 4.5 up to and including 4.5.16; from 4.6 up to and including 4.6.13; from 4.7 up to and including 4.7.12; from 4.8 up to and including 4.8.8; from 4.9 up to and including 4.9.9; from 5.0 up to and including 5.0.3; from 5.1 up to and including 5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.28
From 3.8 up to and including 3.8.28
From 3.9 up to and including 3.9.26
From 4.0 up to and including 4.0.25
From 4.1 up to and including 4.1.25
From 4.2 up to and including 4.2.22
From 4.3 up to and including 4.3.18
From 4.4 up to and including 4.4.17
From 4.5 up to and including 4.5.16
From 4.6 up to and including 4.6.13
From 4.7 up to and including 4.7.12
From 4.8 up to and including 4.8.8
From 4.9 up to and including 4.9.9
From 5.0 up to and including 5.0.3
From 5.1 up to and including 5.1

Fixed in

3.7.29, 3.8.29, 3.9.27, 4.0.26, 4.1.26, 4.2.23, 4.3.19, 4.4.18, 4.5.17, 4.6.14, 4.7.13, 4.8.9, 4.9.10, 5.0.4, 5.1.1

What to do

If your site has an affected version, update WordPress to version 5.1.1 or newer.

Official ID

CVE-2019-9787

Report title

WordPress Core < 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments

First reported

12 April 2019

Sources

Wordfence, seen 12 April 2019

This week

Someone could run their own code on your site and take it over (before 3.7; from 3.7 up to and including 3.7.27; from 3.8 up to and including 3.8.27; from 3.9 up to and including 3.9.25; from 4.0 up to and including 4.0.24; from 4.1 up to and including 4.1.24; from 4.2 up to and including 4.2.21; from 4.3 up to and including 4.3.17; from 4.4 up to and including 4.4.16; from 4.5 up to and including 4.5.15; from 4.6 up to and including 4.6.12; from 4.7 up to and including 4.7.11; from 4.8 up to and including 4.8.7; from 4.9 up to and including 4.9.8; from 5.0 up to and including 5.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.27
From 3.8 up to and including 3.8.27
From 3.9 up to and including 3.9.25
From 4.0 up to and including 4.0.24
From 4.1 up to and including 4.1.24
From 4.2 up to and including 4.2.21
From 4.3 up to and including 4.3.17
From 4.4 up to and including 4.4.16
From 4.5 up to and including 4.5.15
From 4.6 up to and including 4.6.12
From 4.7 up to and including 4.7.11
From 4.8 up to and including 4.8.7
From 4.9 up to and including 4.9.8
From 5.0 up to and including 5.0

Fixed in

3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1

What to do

If your site has an affected version, update WordPress to version 5.0.1 or newer.

Official ID

CVE-2019-8942

Report title

WordPress Core < 5.0.1 - Remote Code Execution

First reported

19 February 2019

Sources

Wordfence, seen 19 February 2019

This week

Someone could read or delete private files on your server (up to and including 5.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 5.0.2

Fixed in

5.0.3

What to do

If your site has an affected version, update WordPress to version 5.0.3 or newer.

Official ID

CVE-2019-8943

Report title

WordPress Core <= 5.0.3 - Path Traversal and Local File Inclusion

First reported

19 February 2019

Sources

Wordfence, seen 19 February 2019

This week

Someone could in some setups, take over your site (before 3.7; from 3.7 up to and including 3.7.27; from 3.8 up to and including 3.8.27; from 3.9 up to and including 3.9.25; from 4.0 up to and including 4.0.24; from 4.1 up to and including 4.1.24; from 4.2 up to and including 4.2.21; from 4.3 up to and including 4.3.17; from 4.4 up to and including 4.4.16; from 4.5 up to and including 4.5.15; from 4.6 up to and including 4.6.12; from 4.7 up to and including 4.7.11; from 4.8 up to and including 4.8.7; from 4.9 up to and including 4.9.8; from 5.0 up to and including 5.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.27
From 3.8 up to and including 3.8.27
From 3.9 up to and including 3.9.25
From 4.0 up to and including 4.0.24
From 4.1 up to and including 4.1.24
From 4.2 up to and including 4.2.21
From 4.3 up to and including 4.3.17
From 4.4 up to and including 4.4.16
From 4.5 up to and including 4.5.15
From 4.6 up to and including 4.6.12
From 4.7 up to and including 4.7.11
From 4.8 up to and including 4.8.7
From 4.9 up to and including 4.9.8
From 5.0 up to and including 5.0

Fixed in

3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1

What to do

If your site has an affected version, update WordPress to version 5.0.1 or newer.

Official ID

CVE-2018-20148

Report title

WordPress Core < 5.0.1 - PHP Object Injection

First reported

12 December 2018

Sources

Wordfence, seen 12 December 2018

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.27; from 3.8 up to and including 3.8.27; from 3.9 up to and including 3.9.25; from 4.0 up to and including 4.0.24; from 4.1 up to and including 4.1.24; from 4.2 up to and including 4.2.21; from 4.3 up to and including 4.3.17; from 4.4 up to and including 4.4.16; from 4.5 up to and including 4.5.15; from 4.6 up to and including 4.6.12; from 4.7 up to and including 4.7.11; from 4.8 up to and including 4.8.7; from 4.9 up to and including 4.9.8; from 5.0 up to and including 5.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.27
From 3.8 up to and including 3.8.27
From 3.9 up to and including 3.9.25
From 4.0 up to and including 4.0.24
From 4.1 up to and including 4.1.24
From 4.2 up to and including 4.2.21
From 4.3 up to and including 4.3.17
From 4.4 up to and including 4.4.16
From 4.5 up to and including 4.5.15
From 4.6 up to and including 4.6.12
From 4.7 up to and including 4.7.11
From 4.8 up to and including 4.8.7
From 4.9 up to and including 4.9.8
From 5.0 up to and including 5.0

Fixed in

3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1

What to do

If your site has an affected version, update WordPress to version 5.0.1 or newer.

Official ID

CVE-2018-20149

Report title

WordPress Core < 5.0.1 - Stored Cross-Site Scripting via File Uploads

First reported

12 December 2018

Sources

Wordfence, seen 12 December 2018

This week

Someone could read or delete private files on your server (before 3.7; from 3.7 up to and including 3.7.27; from 3.8 up to and including 3.8.27; from 3.9 up to and including 3.9.25; from 4.0 up to and including 4.0.24; from 4.1 up to and including 4.1.24; from 4.2 up to and including 4.2.21; from 4.3 up to and including 4.3.17; from 4.4 up to and including 4.4.16; from 4.5 up to and including 4.5.15; from 4.6 up to and including 4.6.12; from 4.7 up to and including 4.7.11; from 4.8 up to and including 4.8.7; from 4.9 up to and including 4.9.8; from 5.0 up to and including 5.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.27
From 3.8 up to and including 3.8.27
From 3.9 up to and including 3.9.25
From 4.0 up to and including 4.0.24
From 4.1 up to and including 4.1.24
From 4.2 up to and including 4.2.21
From 4.3 up to and including 4.3.17
From 4.4 up to and including 4.4.16
From 4.5 up to and including 4.5.15
From 4.6 up to and including 4.6.12
From 4.7 up to and including 4.7.11
From 4.8 up to and including 4.8.7
From 4.9 up to and including 4.9.8
From 5.0 up to and including 5.0

Fixed in

3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1

What to do

If your site has an affected version, update WordPress to version 5.0.1 or newer.

Official ID

CVE-2018-20147

Report title

WordPress Core < 5.0.1 - Arbitrary File Deletion

First reported

12 December 2018

Sources

Wordfence, seen 12 December 2018

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.27; from 3.8 up to and including 3.8.27; from 3.9 up to and including 3.9.25; from 4.0 up to and including 4.0.24; from 4.1 up to and including 4.1.24; from 4.2 up to and including 4.2.21; from 4.3 up to and including 4.3.17; from 4.4 up to and including 4.4.16; from 4.5 up to and including 4.5.15; from 4.6 up to and including 4.6.12; from 4.7 up to and including 4.7.11; from 4.8 up to and including 4.8.7; from 4.9 up to and including 4.9.8; from 5.0 up to and including 5.0) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.27
From 3.8 up to and including 3.8.27
From 3.9 up to and including 3.9.25
From 4.0 up to and including 4.0.24
From 4.1 up to and including 4.1.24
From 4.2 up to and including 4.2.21
From 4.3 up to and including 4.3.17
From 4.4 up to and including 4.4.16
From 4.5 up to and including 4.5.15
From 4.6 up to and including 4.6.12
From 4.7 up to and including 4.7.11
From 4.8 up to and including 4.8.7
From 4.9 up to and including 4.9.8
From 5.0 up to and including 5.0

Fixed in

3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1

What to do

If your site has an affected version, update WordPress to version 5.0.1 or newer.

Official ID

CVE-2018-20153

Report title

WordPress Core < 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments

First reported

12 December 2018

Sources

Wordfence, seen 12 December 2018

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.27; from 3.8 up to and including 3.8.27; from 3.9 up to and including 3.9.25; from 4.0 up to and including 4.0.24; from 4.1 up to and including 4.1.24; from 4.2 up to and including 4.2.21; from 4.3 up to and including 4.3.17; from 4.4 up to and including 4.4.16; from 4.5 up to and including 4.5.15; from 4.6 up to and including 4.6.12; from 4.7 up to and including 4.7.11; from 4.8 up to and including 4.8.7; from 4.9 up to and including 4.9.8; from 5.0 up to and including 5.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.27
From 3.8 up to and including 3.8.27
From 3.9 up to and including 3.9.25
From 4.0 up to and including 4.0.24
From 4.1 up to and including 4.1.24
From 4.2 up to and including 4.2.21
From 4.3 up to and including 4.3.17
From 4.4 up to and including 4.4.16
From 4.5 up to and including 4.5.15
From 4.6 up to and including 4.6.12
From 4.7 up to and including 4.7.11
From 4.8 up to and including 4.8.7
From 4.9 up to and including 4.9.8
From 5.0 up to and including 5.0

Fixed in

3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1

What to do

If your site has an affected version, update WordPress to version 5.0.1 or newer.

Official ID

CVE-2018-20152

Report title

WordPress Core < 5.0.1 - Authorization Bypass

First reported

12 December 2018

Sources

Wordfence, seen 12 December 2018

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.27; from 3.8 up to and including 3.8.27; from 3.9 up to and including 3.9.25; from 4.0 up to and including 4.0.24; from 4.1 up to and including 4.1.24; from 4.2 up to and including 4.2.21; from 4.3 up to and including 4.3.17; from 4.4 up to and including 4.4.16; from 4.5 up to and including 4.5.15; from 4.6 up to and including 4.6.12; from 4.7 up to and including 4.7.11; from 4.8 up to and including 4.8.7; from 4.9 up to and including 4.9.8; from 5.0 up to and including 5.0) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.27
From 3.8 up to and including 3.8.27
From 3.9 up to and including 3.9.25
From 4.0 up to and including 4.0.24
From 4.1 up to and including 4.1.24
From 4.2 up to and including 4.2.21
From 4.3 up to and including 4.3.17
From 4.4 up to and including 4.4.16
From 4.5 up to and including 4.5.15
From 4.6 up to and including 4.6.12
From 4.7 up to and including 4.7.11
From 4.8 up to and including 4.8.7
From 4.9 up to and including 4.9.8
From 5.0 up to and including 5.0

Fixed in

3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1

What to do

If your site has an affected version, update WordPress to version 5.0.1 or newer.

Official ID

CVE-2018-20151

Report title

WordPress Core < 5.0.1 - Sensitive Information Disclosure

First reported

12 December 2018

Sources

Wordfence, seen 12 December 2018

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.27; from 3.8 up to and including 3.8.27; from 3.9 up to and including 3.9.25; from 4.0 up to and including 4.0.24; from 4.1 up to and including 4.1.24; from 4.2 up to and including 4.2.21; from 4.3 up to and including 4.3.17; from 4.4 up to and including 4.4.16; from 4.5 up to and including 4.5.15; from 4.6 up to and including 4.6.12; from 4.7 up to and including 4.7.11; from 4.8 up to and including 4.8.7; from 4.9 up to and including 4.9.8; from 5.0 up to and including 5.0) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.27
From 3.8 up to and including 3.8.27
From 3.9 up to and including 3.9.25
From 4.0 up to and including 4.0.24
From 4.1 up to and including 4.1.24
From 4.2 up to and including 4.2.21
From 4.3 up to and including 4.3.17
From 4.4 up to and including 4.4.16
From 4.5 up to and including 4.5.15
From 4.6 up to and including 4.6.12
From 4.7 up to and including 4.7.11
From 4.8 up to and including 4.8.7
From 4.9 up to and including 4.9.8
From 5.0 up to and including 5.0

Fixed in

3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1

What to do

If your site has an affected version, update WordPress to version 5.0.1 or newer.

Official ID

CVE-2018-20150

Report title

WordPress Core < 5.0.1 Reflected Cross-Site Scripting

First reported

12 December 2018

Sources

Wordfence, seen 12 December 2018

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.27; from 3.8 up to and including 3.8.27; from 3.9 up to and including 3.9.25; from 4.0 up to and including 4.0.24; from 4.1 up to and including 4.1.24; from 4.2 up to and including 4.2.21; from 4.3 up to and including 4.3.17; from 4.4 up to and including 4.4.16; from 4.5 up to and including 4.5.15; from 4.6 up to and including 4.6.12; from 4.7 up to and including 4.7.11; from 4.8 up to and including 4.8.7; from 4.9 up to and including 4.9.8; from 5.0 up to and including 5.0) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.27
From 3.8 up to and including 3.8.27
From 3.9 up to and including 3.9.25
From 4.0 up to and including 4.0.24
From 4.1 up to and including 4.1.24
From 4.2 up to and including 4.2.21
From 4.3 up to and including 4.3.17
From 4.4 up to and including 4.4.16
From 4.5 up to and including 4.5.15
From 4.6 up to and including 4.6.12
From 4.7 up to and including 4.7.11
From 4.8 up to and including 4.8.7
From 4.9 up to and including 4.9.8
From 5.0 up to and including 5.0

Fixed in

3.7.28, 3.8.28, 3.9.26, 4.0.25, 4.1.25, 4.2.22, 4.3.18, 4.4.17, 4.5.16, 4.6.13, 4.7.12, 4.8.8, 4.9.9, 5.0.1

What to do

If your site has an affected version, update WordPress to version 5.0.1 or newer.

Official ID

CVE-2018-1000773

Report title

WordPress Core < 5.0.1 - PHAR Unserialization

First reported

6 September 2018

Sources

Wordfence, seen 6 September 2018

This week

Someone could use it to harm your site (before 4.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.9

Fixed in

4.9

What to do

If your site has an affected version, update WordPress to version 4.9 or newer.

Official ID

CVE-2017-1000600

Report title

WordPress Core < 4.9 - Insecure Deserialization

First reported

16 August 2018

Sources

Wordfence, seen 16 August 2018

This week

Someone who already has an admin account could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.1
From 4.1 up to and including 4.1.39
From 4.2 up to and including 4.2.36
From 4.3 up to and including 4.3.32
From 4.4 up to and including 4.4.31
From 4.5 up to and including 4.5.30
From 4.6 up to and including 4.6.27
From 4.7 up to and including 4.7.27
From 4.8 up to and including 4.8.23
From 4.9 up to and including 4.9.24
From 5.0 up to and including 5.0.20
From 5.1 up to and including 5.1.17
From 5.2 up to and including 5.2.19
From 5.3 up to and including 5.3.16
From 5.4 up to and including 5.4.14
From 5.5 up to and including 5.5.13
From 5.6 up to and including 5.6.12
From 5.7 up to and including 5.7.10
From 5.8 up to and including 5.8.8
From 5.9 up to and including 5.9.8
From 6.0 up to and including 6.0.6
From 6.1 up to and including 6.1.4
From 6.2 up to and including 6.2.3
From 6.3 up to and including 6.3.2
From 6.4 up to and including 6.4.2

Fixed in

4.1.40, 4.2.37, 4.3.33, 4.4.32, 4.5.31, 4.6.28, 4.7.28, 4.8.24, 4.9.25, 5.0.21, 5.1.18, 5.2.20, 5.3.17, 5.4.15, 5.5.14, 5.6.13, 5.7.11, 5.8.9, 5.9.9, 6.0.7, 6.1.5, 6.2.4, 6.3.3, 6.4.3

What to do

If your site has an affected version, update WordPress to version 6.4.3 or newer.

Official ID

CVE-2018-14028

Report title

WordPress Core < 6.4.3 - Authenticated(Administrator+) PHP File Upload

First reported

4 August 2018

Sources

Wordfence, seen 4 August 2018

This week

Someone could read or delete private files on your server (before 3.7; from 3.7 up to and including 3.7.26; from 3.8 up to and including 3.8.26; from 3.9 up to and including 3.9.24; from 4.0 up to and including 4.0.23; from 4.1 up to and including 4.1.23; from 4.2 up to and including 4.2.20; from 4.3 up to and including 4.3.16; from 4.4 up to and including 4.4.15; from 4.5 up to and including 4.5.14; from 4.6 up to and including 4.6.11; from 4.7 up to and including 4.7.10; from 4.8 up to and including 4.8.6; from 4.9 up to and including 4.9.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.26
From 3.8 up to and including 3.8.26
From 3.9 up to and including 3.9.24
From 4.0 up to and including 4.0.23
From 4.1 up to and including 4.1.23
From 4.2 up to and including 4.2.20
From 4.3 up to and including 4.3.16
From 4.4 up to and including 4.4.15
From 4.5 up to and including 4.5.14
From 4.6 up to and including 4.6.11
From 4.7 up to and including 4.7.10
From 4.8 up to and including 4.8.6
From 4.9 up to and including 4.9.6

Fixed in

3.7.27, 3.8.27, 3.9.25, 4.0.24, 4.1.24, 4.2.21, 4.3.17, 4.4.16, 4.5.15, 4.6.12, 4.7.11, 4.8.7, 4.9.7

What to do

If your site has an affected version, update WordPress to version 4.9.7 or newer.

Official ID

CVE-2018-12895

Report title

WordPress Core < 4.9.7 - Authenticated Arbitrary File Deletion

First reported

5 July 2018

Sources

Wordfence, seen 5 July 2018

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.25; from 3.8 up to and including 3.8.25; from 3.9 up to and including 3.9.23; from 4.0 up to and including 4.0.22; from 4.1 up to and including 4.1.22; from 4.2 up to and including 4.2.19; from 4.3 up to and including 4.3.15; from 4.4 up to and including 4.4.14; from 4.5 up to and including 4.5.13; from 4.6 up to and including 4.6.10; from 4.7 up to and including 4.7.9; from 4.8 up to and including 4.8.5; from 4.9 up to and including 4.9.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.25
From 3.8 up to and including 3.8.25
From 3.9 up to and including 3.9.23
From 4.0 up to and including 4.0.22
From 4.1 up to and including 4.1.22
From 4.2 up to and including 4.2.19
From 4.3 up to and including 4.3.15
From 4.4 up to and including 4.4.14
From 4.5 up to and including 4.5.13
From 4.6 up to and including 4.6.10
From 4.7 up to and including 4.7.9
From 4.8 up to and including 4.8.5
From 4.9 up to and including 4.9.4

Fixed in

3.7.26, 3.8.26, 3.9.24, 4.0.23, 4.1.23, 4.2.20, 4.3.16, 4.4.15, 4.5.14, 4.6.11, 4.7.10, 4.8.6, 4.9.5

What to do

If your site has an affected version, update WordPress to version 4.9.5 or newer.

Official ID

CVE-2018-10101

Report title

WordPress Core < 4.9.5 - Security Misconfiguration with URL Hostnames

First reported

3 April 2018

Sources

Wordfence, seen 3 April 2018

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.25; from 3.8 up to and including 3.8.25; from 3.9 up to and including 3.9.23; from 4.0 up to and including 4.0.22; from 4.1 up to and including 4.1.22; from 4.2 up to and including 4.2.19; from 4.3 up to and including 4.3.15; from 4.4 up to and including 4.4.14; from 4.5 up to and including 4.5.13; from 4.6 up to and including 4.6.10; from 4.7 up to and including 4.7.9; from 4.8 up to and including 4.8.5; from 4.9 up to and including 4.9.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.25
From 3.8 up to and including 3.8.25
From 3.9 up to and including 3.9.23
From 4.0 up to and including 4.0.22
From 4.1 up to and including 4.1.22
From 4.2 up to and including 4.2.19
From 4.3 up to and including 4.3.15
From 4.4 up to and including 4.4.14
From 4.5 up to and including 4.5.13
From 4.6 up to and including 4.6.10
From 4.7 up to and including 4.7.9
From 4.8 up to and including 4.8.5
From 4.9 up to and including 4.9.4

Fixed in

3.7.26, 3.8.26, 3.9.24, 4.0.23, 4.1.23, 4.2.20, 4.3.16, 4.4.15, 4.5.14, 4.6.11, 4.7.10, 4.8.6, 4.9.5

What to do

If your site has an affected version, update WordPress to version 4.9.5 or newer.

Official ID

CVE-2018-10102

Report title

WordPress Core < 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag

First reported

3 April 2018

Sources

Wordfence, seen 3 April 2018

This week

Someone could send your visitors from your site to a harmful site (before 3.7; from 3.7 up to and including 3.7.25; from 3.8 up to and including 3.8.25; from 3.9 up to and including 3.9.23; from 4.0 up to and including 4.0.22; from 4.1 up to and including 4.1.22; from 4.2 up to and including 4.2.19; from 4.3 up to and including 4.3.15; from 4.4 up to and including 4.4.14; from 4.5 up to and including 4.5.13; from 4.6 up to and including 4.6.10; from 4.7 up to and including 4.7.9; from 4.8 up to and including 4.8.5; from 4.9 up to and including 4.9.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.25
From 3.8 up to and including 3.8.25
From 3.9 up to and including 3.9.23
From 4.0 up to and including 4.0.22
From 4.1 up to and including 4.1.22
From 4.2 up to and including 4.2.19
From 4.3 up to and including 4.3.15
From 4.4 up to and including 4.4.14
From 4.5 up to and including 4.5.13
From 4.6 up to and including 4.6.10
From 4.7 up to and including 4.7.9
From 4.8 up to and including 4.8.5
From 4.9 up to and including 4.9.4

Fixed in

3.7.26, 3.8.26, 3.9.24, 4.0.23, 4.1.23, 4.2.20, 4.3.16, 4.4.15, 4.5.14, 4.6.11, 4.7.10, 4.8.6, 4.9.5

What to do

If your site has an affected version, update WordPress to version 4.9.5 or newer.

Official ID

CVE-2018-10100

Report title

WordPress Core < 4.9.5 - Open Redirect

First reported

3 April 2018

Sources

Wordfence, seen 3 April 2018

This week

Someone could slow down or crash your site (before 5.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 5.0

Fixed in

5.0

What to do

If your site has an affected version, update WordPress to version 5.0 or newer.

Official ID

CVE-2018-6389

Report title

WordPress Core < 5.0 - Denial of Service

First reported

5 February 2018

Sources

Wordfence, seen 5 February 2018

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.6.1; from 3.7 up to and including 3.7.24; from 3.8 up to and including 3.8.24; from 3.9 up to and including 3.9.22; from 4.0 up to and including 4.0.21; from 4.1 up to and including 4.1.21; from 4.2 up to and including 4.2.18; from 4.3 up to and including 4.3.14; from 4.4 up to and including 4.4.13; from 4.5 up to and including 4.5.12; from 4.6 up to and including 4.6.9; from 4.7 up to and including 4.7.8; from 4.8 up to and including 4.8.4; from 4.9 up to and including 4.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.24
From 3.8 up to and including 3.8.24
From 3.9 up to and including 3.9.22
From 4.0 up to and including 4.0.21
From 4.1 up to and including 4.1.21
From 4.2 up to and including 4.2.18
From 4.3 up to and including 4.3.14
From 4.4 up to and including 4.4.13
From 4.5 up to and including 4.5.12
From 4.6 up to and including 4.6.9
From 4.7 up to and including 4.7.8
From 4.8 up to and including 4.8.4
From 4.9 up to and including 4.9.1

Fixed in

3.7.25, 3.8.25, 3.9.23, 4.0.22, 4.1.22, 4.2.19, 4.3.15, 4.4.14, 4.5.13, 4.6.10, 4.7.9, 4.8.5, 4.9.2

What to do

If your site has an affected version, update WordPress to version 4.9.2 or newer.

Official ID

CVE-2018-5776

Report title

WordPress Core < 4.9.2 - Authenticated Cross-Site Scripting

First reported

16 January 2018

Sources

Wordfence, seen 16 January 2018

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.23; from 3.8 up to and including 3.8.23; from 3.9 up to and including 3.9.21; from 4.0 up to and including 4.0.20; from 4.1 up to and including 4.1.20; from 4.2 up to and including 4.2.17; from 4.3 up to and including 4.3.13; from 4.4 up to and including 4.4.12; from 4.5 up to and including 4.5.11; from 4.6 up to and including 4.6.8; from 4.7 up to and including 4.7.7; from 4.8 up to and including 4.8.3; from 4.9 up to and including 4.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.23
From 3.8 up to and including 3.8.23
From 3.9 up to and including 3.9.21
From 4.0 up to and including 4.0.20
From 4.1 up to and including 4.1.20
From 4.2 up to and including 4.2.17
From 4.3 up to and including 4.3.13
From 4.4 up to and including 4.4.12
From 4.5 up to and including 4.5.11
From 4.6 up to and including 4.6.8
From 4.7 up to and including 4.7.7
From 4.8 up to and including 4.8.3
From 4.9 up to and including 4.9

Fixed in

3.7.24, 3.8.24, 3.9.22, 4.0.21, 4.1.21, 4.2.18, 4.3.14, 4.4.13, 4.5.12, 4.6.9, 4.7.8, 4.8.4, 4.9.1

What to do

If your site has an affected version, update WordPress to version 4.9.1 or newer.

Official ID

CVE-2017-17094

Report title

WordPress Core < 4.9.1 - Reflected Cross-Site Scripting

First reported

29 November 2017

Sources

Wordfence, seen 29 November 2017

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.23; from 3.8 up to and including 3.8.23; from 3.9 up to and including 3.9.21; from 4.0 up to and including 4.0.20; from 4.1 up to and including 4.1.20; from 4.2 up to and including 4.2.17; from 4.3 up to and including 4.3.13; from 4.4 up to and including 4.4.12; from 4.5 up to and including 4.5.11; from 4.6 up to and including 4.6.8; from 4.7 up to and including 4.7.7; from 4.8 up to and including 4.8.3; from 4.9 up to and including 4.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.23
From 3.8 up to and including 3.8.23
From 3.9 up to and including 3.9.21
From 4.0 up to and including 4.0.20
From 4.1 up to and including 4.1.20
From 4.2 up to and including 4.2.17
From 4.3 up to and including 4.3.13
From 4.4 up to and including 4.4.12
From 4.5 up to and including 4.5.11
From 4.6 up to and including 4.6.8
From 4.7 up to and including 4.7.7
From 4.8 up to and including 4.8.3
From 4.9 up to and including 4.9

Fixed in

3.7.24, 3.8.24, 3.9.22, 4.0.21, 4.1.21, 4.2.18, 4.3.14, 4.4.13, 4.5.12, 4.6.9, 4.7.8, 4.8.4, 4.9.1

What to do

If your site has an affected version, update WordPress to version 4.9.1 or newer.

Official ID

CVE-2017-17091

Report title

WordPress Core < 4.9.1 - Authorization Bypass

First reported

29 November 2017

Sources

Wordfence, seen 29 November 2017

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.23; from 3.8 up to and including 3.8.23; from 3.9 up to and including 3.9.21; from 4.0 up to and including 4.0.20; from 4.1 up to and including 4.1.20; from 4.2 up to and including 4.2.17; from 4.3 up to and including 4.3.13; from 4.4 up to and including 4.4.12; from 4.5 up to and including 4.5.11; from 4.6 up to and including 4.6.8; from 4.7 up to and including 4.7.7; from 4.8 up to and including 4.8.3; from 4.9 up to and including 4.9) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.23
From 3.8 up to and including 3.8.23
From 3.9 up to and including 3.9.21
From 4.0 up to and including 4.0.20
From 4.1 up to and including 4.1.20
From 4.2 up to and including 4.2.17
From 4.3 up to and including 4.3.13
From 4.4 up to and including 4.4.12
From 4.5 up to and including 4.5.11
From 4.6 up to and including 4.6.8
From 4.7 up to and including 4.7.7
From 4.8 up to and including 4.8.3
From 4.9 up to and including 4.9

Fixed in

3.7.24, 3.8.24, 3.9.22, 4.0.21, 4.1.21, 4.2.18, 4.3.14, 4.4.13, 4.5.12, 4.6.9, 4.7.8, 4.8.4, 4.9.1

What to do

If your site has an affected version, update WordPress to version 4.9.1 or newer.

Official ID

CVE-2017-17093

Report title

WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language

First reported

29 November 2017

Sources

Wordfence, seen 29 November 2017

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.23; from 3.8 up to and including 3.8.23; from 3.9 up to and including 3.9.21; from 4.0 up to and including 4.0.20; from 4.1 up to and including 4.1.20; from 4.2 up to and including 4.2.17; from 4.3 up to and including 4.3.13; from 4.4 up to and including 4.4.12; from 4.5 up to and including 4.5.11; from 4.6 up to and including 4.6.8; from 4.7 up to and including 4.7.7; from 4.8 up to and including 4.8.3; from 4.9 up to and including 4.9) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.23
From 3.8 up to and including 3.8.23
From 3.9 up to and including 3.9.21
From 4.0 up to and including 4.0.20
From 4.1 up to and including 4.1.20
From 4.2 up to and including 4.2.17
From 4.3 up to and including 4.3.13
From 4.4 up to and including 4.4.12
From 4.5 up to and including 4.5.11
From 4.6 up to and including 4.6.8
From 4.7 up to and including 4.7.7
From 4.8 up to and including 4.8.3
From 4.9 up to and including 4.9

Fixed in

3.7.24, 3.8.24, 3.9.22, 4.0.21, 4.1.21, 4.2.18, 4.3.14, 4.4.13, 4.5.12, 4.6.9, 4.7.8, 4.8.4, 4.9.1

What to do

If your site has an affected version, update WordPress to version 4.9.1 or newer.

Official ID

CVE-2017-17092

Report title

WordPress Core < 4.9.1 - Authenticated Stored Cross-Site Scripting

First reported

29 November 2017

Sources

Wordfence, seen 29 November 2017

This week

Someone could read or change the data in your site’s database (before 3.7; from 3.7 up to and including 3.7.22; from 3.8 up to and including 3.8.22; from 3.9 up to and including 3.9.20; from 4.0 up to and including 4.0.19; from 4.1 up to and including 4.1.19; from 4.2 up to and including 4.2.16; from 4.3 up to and including 4.3.12; from 4.4 up to and including 4.4.11; from 4.5 up to and including 4.5.10; from 4.6 up to and including 4.6.7; from 4.7 up to and including 4.7.6; from 4.8 up to and including 4.8.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.22
From 3.8 up to and including 3.8.22
From 3.9 up to and including 3.9.20
From 4.0 up to and including 4.0.19
From 4.1 up to and including 4.1.19
From 4.2 up to and including 4.2.16
From 4.3 up to and including 4.3.12
From 4.4 up to and including 4.4.11
From 4.5 up to and including 4.5.10
From 4.6 up to and including 4.6.7
From 4.7 up to and including 4.7.6
From 4.8 up to and including 4.8.2

Fixed in

3.7.23, 3.8.23, 3.9.21, 4.0.20, 4.1.20, 4.2.17, 4.3.13, 4.4.12, 4.5.11, 4.6.8, 4.7.7, 4.8.3

What to do

If your site has an affected version, update WordPress to version 4.8.3 or newer.

Official ID

CVE-2017-16510

Report title

WordPress Core < 4.8.3 - SQL Injection due to Double Prepare approach

First reported

31 October 2017

Sources

Wordfence, seen 31 October 2017

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.24; from 3.8 up to and including 3.8.24; from 3.9 up to and including 3.9.23; from 4.0 up to and including 4.0.21; from 4.1 up to and including 4.1.21; from 4.2 up to and including 4.2.18; from 4.3 up to and including 4.3.14; from 4.4 up to and including 4.4.13; from 4.5 up to and including 4.5.12; from 4.6 up to and including 4.6.9; from 4.7 up to and including 4.7.8; from 4.8 up to and including 4.8.4; from 4.9 up to and including 4.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.24
From 3.8 up to and including 3.8.24
From 3.9 up to and including 3.9.23
From 4.0 up to and including 4.0.21
From 4.1 up to and including 4.1.21
From 4.2 up to and including 4.2.18
From 4.3 up to and including 4.3.14
From 4.4 up to and including 4.4.13
From 4.5 up to and including 4.5.12
From 4.6 up to and including 4.6.9
From 4.7 up to and including 4.7.8
From 4.8 up to and including 4.8.4
From 4.9 up to and including 4.9.1

Fixed in

3.7.25, 3.8.25, 3.9.24, 4.0.22, 4.1.22, 4.2.19, 4.3.15, 4.4.14, 4.5.13, 4.6.10, 4.7.9, 4.8.5, 4.9.2

What to do

If your site has an affected version, update WordPress to version 4.9.2 or newer.

Official ID

CVE-2016-9263

Report title

WordPress Core < 4.9.1 - Cross-domain Flash injection

First reported

10 October 2017

Sources

Wordfence, seen 10 October 2017

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.21; from 3.8 up to and including 3.8.21; from 3.9 up to and including 3.9.19; from 4.0 up to and including 4.0.18; from 4.1 up to and including 4.1.18; from 4.2 up to and including 4.2.15; from 4.3 up to and including 4.3.11; from 4.4 up to and including 4.4.10; from 4.5 up to and including 4.5.9; from 4.6 up to and including 4.6.6; from 4.7 up to and including 4.7.5; from 4.8 up to and including 4.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.21
From 3.8 up to and including 3.8.21
From 3.9 up to and including 3.9.19
From 4.0 up to and including 4.0.18
From 4.1 up to and including 4.1.18
From 4.2 up to and including 4.2.15
From 4.3 up to and including 4.3.11
From 4.4 up to and including 4.4.10
From 4.5 up to and including 4.5.9
From 4.6 up to and including 4.6.6
From 4.7 up to and including 4.7.5
From 4.8 up to and including 4.8.1

Fixed in

3.7.22, 3.8.22, 3.9.20, 4.0.19, 4.1.19, 4.2.16, 4.3.12, 4.4.11, 4.5.10, 4.6.7, 4.7.6, 4.8.2

What to do

If your site has an affected version, update WordPress to version 4.8.2 or newer.

Official ID

CVE-2017-14721

Report title

WordPress Core < 4.8.2 - Stored Cross-Site Scripting via Plugin Names

First reported

19 September 2017

Sources

Wordfence, seen 19 September 2017

This week

Someone could read or change the data in your site’s database (before 3.7; from 3.7 up to and including 3.7.21; from 3.8 up to and including 3.8.21; from 3.9 up to and including 3.9.19; from 4.0 up to and including 4.0.18; from 4.1 up to and including 4.1.18; from 4.2 up to and including 4.2.15; from 4.3 up to and including 4.3.11; from 4.4 up to and including 4.4.10; from 4.5 up to and including 4.5.9; from 4.6 up to and including 4.6.6; from 4.7 up to and including 4.7.5; from 4.8 up to and including 4.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.21
From 3.8 up to and including 3.8.21
From 3.9 up to and including 3.9.19
From 4.0 up to and including 4.0.18
From 4.1 up to and including 4.1.18
From 4.2 up to and including 4.2.15
From 4.3 up to and including 4.3.11
From 4.4 up to and including 4.4.10
From 4.5 up to and including 4.5.9
From 4.6 up to and including 4.6.6
From 4.7 up to and including 4.7.5
From 4.8 up to and including 4.8.1

Fixed in

3.7.22, 3.8.22, 3.9.20, 4.0.19, 4.1.19, 4.2.16, 4.3.12, 4.4.11, 4.5.10, 4.6.7, 4.7.6, 4.8.2

What to do

If your site has an affected version, update WordPress to version 4.8.2 or newer.

Official ID

CVE-2017-14723

Report title

WordPress Core < 4.8.2 - SQL Injection via Mishandled Placeholders

First reported

19 September 2017

Sources

Wordfence, seen 19 September 2017

This week

Someone could send your visitors from your site to a harmful site (before 3.7; from 3.7 up to and including 3.7.21; from 3.8 up to and including 3.8.21; from 3.9 up to and including 3.9.19; from 4.0 up to and including 4.0.18; from 4.1 up to and including 4.1.18; from 4.2 up to and including 4.2.15; from 4.3 up to and including 4.3.11; from 4.4 up to and including 4.4.10; from 4.5 up to and including 4.5.9; from 4.6 up to and including 4.6.6; from 4.7 up to and including 4.7.5; from 4.8 up to and including 4.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.21
From 3.8 up to and including 3.8.21
From 3.9 up to and including 3.9.19
From 4.0 up to and including 4.0.18
From 4.1 up to and including 4.1.18
From 4.2 up to and including 4.2.15
From 4.3 up to and including 4.3.11
From 4.4 up to and including 4.4.10
From 4.5 up to and including 4.5.9
From 4.6 up to and including 4.6.6
From 4.7 up to and including 4.7.5
From 4.8 up to and including 4.8.1

Fixed in

3.7.22, 3.8.22, 3.9.20, 4.0.19, 4.1.19, 4.2.16, 4.3.12, 4.4.11, 4.5.10, 4.6.7, 4.7.6, 4.8.2

What to do

If your site has an affected version, update WordPress to version 4.8.2 or newer.

Official ID

CVE-2017-14725

Report title

WordPress Core < 4.8.2 - Open Redirect in Admin Dashboard

First reported

19 September 2017

Sources

Wordfence, seen 19 September 2017

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.21; from 3.8 up to and including 3.8.21; from 3.9 up to and including 3.9.19; from 4.0 up to and including 4.0.18; from 4.1 up to and including 4.1.18; from 4.2 up to and including 4.2.15; from 4.3 up to and including 4.3.11; from 4.4 up to and including 4.4.10; from 4.5 up to and including 4.5.9; from 4.6 up to and including 4.6.6; from 4.7 up to and including 4.7.5; from 4.8 up to and including 4.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.21
From 3.8 up to and including 3.8.21
From 3.9 up to and including 3.9.19
From 4.0 up to and including 4.0.18
From 4.1 up to and including 4.1.18
From 4.2 up to and including 4.2.15
From 4.3 up to and including 4.3.11
From 4.4 up to and including 4.4.10
From 4.5 up to and including 4.5.9
From 4.6 up to and including 4.6.6
From 4.7 up to and including 4.7.5
From 4.8 up to and including 4.8.1

Fixed in

3.7.22, 3.8.22, 3.9.20, 4.0.19, 4.1.19, 4.2.16, 4.3.12, 4.4.11, 4.5.10, 4.6.7, 4.7.6, 4.8.2

What to do

If your site has an affected version, update WordPress to version 4.8.2 or newer.

Official ID

CVE-2017-14719

Report title

WordPress Core < 4.8.2 - Directory Traversal during unzip

First reported

19 September 2017

Sources

Wordfence, seen 19 September 2017

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.21; from 3.8 up to and including 3.8.21; from 3.9 up to and including 3.9.19; from 4.0 up to and including 4.0.18; from 4.1 up to and including 4.1.18; from 4.2 up to and including 4.2.15; from 4.3 up to and including 4.3.11; from 4.4 up to and including 4.4.10; from 4.5 up to and including 4.5.9; from 4.6 up to and including 4.6.6; from 4.7 up to and including 4.7.5; from 4.8 up to and including 4.8.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.21
From 3.8 up to and including 3.8.21
From 3.9 up to and including 3.9.19
From 4.0 up to and including 4.0.18
From 4.1 up to and including 4.1.18
From 4.2 up to and including 4.2.15
From 4.3 up to and including 4.3.11
From 4.4 up to and including 4.4.10
From 4.5 up to and including 4.5.9
From 4.6 up to and including 4.6.6
From 4.7 up to and including 4.7.5
From 4.8 up to and including 4.8.1

Fixed in

3.7.22, 3.8.22, 3.9.20, 4.0.19, 4.1.19, 4.2.16, 4.3.12, 4.4.11, 4.5.10, 4.6.7, 4.7.6, 4.8.2

What to do

If your site has an affected version, update WordPress to version 4.8.2 or newer.

Official ID

CVE-2017-14726

Report title

WordPress Core < 4.8.2 - Cross-Site Scripting via Shortcodes

First reported

19 September 2017

Sources

Wordfence, seen 19 September 2017

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.21; from 3.8 up to and including 3.8.21; from 3.9 up to and including 3.9.19; from 4.0 up to and including 4.0.18; from 4.1 up to and including 4.1.18; from 4.2 up to and including 4.2.15; from 4.3 up to and including 4.3.11; from 4.4 up to and including 4.4.10; from 4.5 up to and including 4.5.9; from 4.6 up to and including 4.6.6; from 4.7 up to and including 4.7.5; from 4.8 up to and including 4.8.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.21
From 3.8 up to and including 3.8.21
From 3.9 up to and including 3.9.19
From 4.0 up to and including 4.0.18
From 4.1 up to and including 4.1.18
From 4.2 up to and including 4.2.15
From 4.3 up to and including 4.3.11
From 4.4 up to and including 4.4.10
From 4.5 up to and including 4.5.9
From 4.6 up to and including 4.6.6
From 4.7 up to and including 4.7.5
From 4.8 up to and including 4.8.1

Fixed in

3.7.22, 3.8.22, 3.9.20, 4.0.19, 4.1.19, 4.2.16, 4.3.12, 4.4.11, 4.5.10, 4.6.7, 4.7.6, 4.8.2

What to do

If your site has an affected version, update WordPress to version 4.8.2 or newer.

Official ID

CVE-2017-14722

Report title

WordPress Core < 4.8.2 - Directory Traversal via Customizer

First reported

19 September 2017

Sources

Wordfence, seen 19 September 2017

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.21; from 3.8 up to and including 3.8.21; from 3.9 up to and including 3.9.19; from 4.0 up to and including 4.0.18; from 4.1 up to and including 4.1.18; from 4.2 up to and including 4.2.15; from 4.3 up to and including 4.3.11; from 4.4 up to and including 4.4.10; from 4.5 up to and including 4.5.9; from 4.6 up to and including 4.6.6; from 4.7 up to and including 4.7.5; from 4.8 up to and including 4.8.1) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.21
From 3.8 up to and including 3.8.21
From 3.9 up to and including 3.9.19
From 4.0 up to and including 4.0.18
From 4.1 up to and including 4.1.18
From 4.2 up to and including 4.2.15
From 4.3 up to and including 4.3.11
From 4.4 up to and including 4.4.10
From 4.5 up to and including 4.5.9
From 4.6 up to and including 4.6.6
From 4.7 up to and including 4.7.5
From 4.8 up to and including 4.8.1

Fixed in

3.7.22, 3.8.22, 3.9.20, 4.0.19, 4.1.19, 4.2.16, 4.3.12, 4.4.11, 4.5.10, 4.6.7, 4.7.6, 4.8.2

What to do

If your site has an affected version, update WordPress to version 4.8.2 or newer.

Official ID

CVE-2017-14720

Report title

WordPress Core < 4.8.2 - Cross-Site Scripting via Template Name

First reported

19 September 2017

Sources

Wordfence, seen 19 September 2017

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.21; from 3.8 up to and including 3.8.21; from 3.9 up to and including 3.9.19; from 4.0 up to and including 4.0.18; from 4.1 up to and including 4.1.18; from 4.2 up to and including 4.2.15; from 4.3 up to and including 4.3.11; from 4.4 up to and including 4.4.10; from 4.5 up to and including 4.5.9; from 4.6 up to and including 4.6.6; from 4.7 up to and including 4.7.5; from 4.8 up to and including 4.8.1) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.21
From 3.8 up to and including 3.8.21
From 3.9 up to and including 3.9.19
From 4.0 up to and including 4.0.18
From 4.1 up to and including 4.1.18
From 4.2 up to and including 4.2.15
From 4.3 up to and including 4.3.11
From 4.4 up to and including 4.4.10
From 4.5 up to and including 4.5.9
From 4.6 up to and including 4.6.6
From 4.7 up to and including 4.7.5
From 4.8 up to and including 4.8.1

Fixed in

3.7.22, 3.8.22, 3.9.20, 4.0.19, 4.1.19, 4.2.16, 4.3.12, 4.4.11, 4.5.10, 4.6.7, 4.7.6, 4.8.2

What to do

If your site has an affected version, update WordPress to version 4.8.2 or newer.

Official ID

CVE-2017-14724

Report title

WordPress Core < 4.8.2 - Cross-Site Scripting in oEmbed

First reported

19 September 2017

Sources

Wordfence, seen 19 September 2017

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.21; from 3.8 up to and including 3.8.21; from 3.9 up to and including 3.9.19; from 4.0 up to and including 4.0.18; from 4.1 up to and including 4.1.18; from 4.2 up to and including 4.2.15; from 4.3 up to and including 4.3.11; from 4.4 up to and including 4.4.10; from 4.5 up to and including 4.5.9; from 4.6 up to and including 4.6.6; from 4.7 up to and including 4.7.5; from 4.8 up to and including 4.8.1) (5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.21
From 3.8 up to and including 3.8.21
From 3.9 up to and including 3.9.19
From 4.0 up to and including 4.0.18
From 4.1 up to and including 4.1.18
From 4.2 up to and including 4.2.15
From 4.3 up to and including 4.3.11
From 4.4 up to and including 4.4.10
From 4.5 up to and including 4.5.9
From 4.6 up to and including 4.6.6
From 4.7 up to and including 4.7.5
From 4.8 up to and including 4.8.1

Fixed in

3.7.22, 3.8.22, 3.9.20, 4.0.19, 4.1.19, 4.2.16, 4.3.12, 4.4.11, 4.5.10, 4.6.7, 4.7.6, 4.8.2

What to do

If your site has an affected version, update WordPress to version 4.8.2 or newer.

Official ID

CVE-2017-14718

Report title

WordPress Core < 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs

First reported

19 September 2017

Sources

Wordfence, seen 19 September 2017

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.7.20; from 3.8 up to and including 3.8.20; from 3.9 up to and including 3.9.18; from 4.0 up to and including 4.0.17; from 4.1 up to and including 4.1.17; from 4.2 up to and including 4.2.14; from 4.3 up to and including 4.3.10; from 4.4 up to and including 4.4.9; from 4.5 up to and including 4.5.8; from 4.6 up to and including 4.6.5; from 4.7 up to and including 4.7.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.7.20
From 3.8 up to and including 3.8.20
From 3.9 up to and including 3.9.18
From 4.0 up to and including 4.0.17
From 4.1 up to and including 4.1.17
From 4.2 up to and including 4.2.14
From 4.3 up to and including 4.3.10
From 4.4 up to and including 4.4.9
From 4.5 up to and including 4.5.8
From 4.6 up to and including 4.6.5
From 4.7 up to and including 4.7.4

Fixed in

3.7.21, 3.8.21, 3.9.19, 4.0.18, 4.1.18, 4.2.15, 4.3.11, 4.4.10, 4.5.9, 4.6.6, 4.7.5

What to do

If your site has an affected version, update WordPress to version 4.7.5 or newer.

Official ID

CVE-2017-9061

Report title

WordPress Core < 4.7.5 - Stored Cross-Site Scripting via filenames

First reported

16 May 2017

Sources

Wordfence, seen 16 May 2017

This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.7; from 3.7 up to and including 3.7.20; from 3.8 up to and including 3.8.20; from 3.9 up to and including 3.9.18; from 4.0 up to and including 4.0.17; from 4.1 up to and including 4.1.17; from 4.2 up to and including 4.2.14; from 4.3 up to and including 4.3.10; from 4.4 up to and including 4.4.9; from 4.5 up to and including 4.5.8; from 4.6 up to and including 4.6.5; from 4.7 up to and including 4.7.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.20
From 3.8 up to and including 3.8.20
From 3.9 up to and including 3.9.18
From 4.0 up to and including 4.0.17
From 4.1 up to and including 4.1.17
From 4.2 up to and including 4.2.14
From 4.3 up to and including 4.3.10
From 4.4 up to and including 4.4.9
From 4.5 up to and including 4.5.8
From 4.6 up to and including 4.6.5
From 4.7 up to and including 4.7.4

Fixed in

3.7.21, 3.8.21, 3.9.19, 4.0.18, 4.1.18, 4.2.15, 4.3.11, 4.4.10, 4.5.9, 4.6.6, 4.7.5

What to do

If your site has an affected version, update WordPress to version 4.7.5 or newer.

Official ID

CVE-2017-9064

Report title

WordPress Core < 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update

First reported

16 May 2017

Sources

Wordfence, seen 16 May 2017

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.20; from 3.8 up to and including 3.8.20; from 3.9 up to and including 3.9.18; from 4.0 up to and including 4.0.17; from 4.1 up to and including 4.1.17; from 4.2 up to and including 4.2.14; from 4.3 up to and including 4.3.10; from 4.4 up to and including 4.4.9; from 4.5 up to and including 4.5.8; from 4.6 up to and including 4.6.5; from 4.7 up to and including 4.7.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.20
From 3.8 up to and including 3.8.20
From 3.9 up to and including 3.9.18
From 4.0 up to and including 4.0.17
From 4.1 up to and including 4.1.17
From 4.2 up to and including 4.2.14
From 4.3 up to and including 4.3.10
From 4.4 up to and including 4.4.9
From 4.5 up to and including 4.5.8
From 4.6 up to and including 4.6.5
From 4.7 up to and including 4.7.4

Fixed in

3.7.21, 3.8.21, 3.9.19, 4.0.18, 4.1.18, 4.2.15, 4.3.11, 4.4.10, 4.5.9, 4.6.6, 4.7.5

What to do

If your site has an affected version, update WordPress to version 4.7.5 or newer.

Official ID

CVE-2017-9065

Report title

WordPress Core < 4.7.5 - Authorization Bypass Allowing Post Meta Updates

First reported

16 May 2017

Sources

Wordfence, seen 16 May 2017

This week

Someone could make your server visit other addresses on their behalf (before 3.7; from 3.7 up to and including 3.7.20; from 3.8 up to and including 3.8.20; from 3.9 up to and including 3.9.18; from 4.0 up to and including 4.0.17; from 4.1 up to and including 4.1.17; from 4.2 up to and including 4.2.14; from 4.3 up to and including 4.3.10; from 4.4 up to and including 4.4.9; from 4.5 up to and including 4.5.8; from 4.6 up to and including 4.6.5; from 4.7 up to and including 4.7.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.20
From 3.8 up to and including 3.8.20
From 3.9 up to and including 3.9.18
From 4.0 up to and including 4.0.17
From 4.1 up to and including 4.1.17
From 4.2 up to and including 4.2.14
From 4.3 up to and including 4.3.10
From 4.4 up to and including 4.4.9
From 4.5 up to and including 4.5.8
From 4.6 up to and including 4.6.5
From 4.7 up to and including 4.7.4

Fixed in

3.7.21, 3.8.21, 3.9.19, 4.0.18, 4.1.18, 4.2.15, 4.3.11, 4.4.10, 4.5.9, 4.6.6, 4.7.5

What to do

If your site has an affected version, update WordPress to version 4.7.5 or newer.

Official ID

CVE-2017-9066

Report title

WordPress Core < 4.7.5 - Server-Side Request Forgery

First reported

16 May 2017

Sources

Wordfence, seen 16 May 2017

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.20; from 3.8 up to and including 3.8.20; from 3.9 up to and including 3.9.18; from 4.0 up to and including 4.0.17; from 4.1 up to and including 4.1.17; from 4.2 up to and including 4.2.14; from 4.3 up to and including 4.3.10; from 4.4 up to and including 4.4.9; from 4.5 up to and including 4.5.8; from 4.6 up to and including 4.6.5; from 4.7 up to and including 4.7.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.20
From 3.8 up to and including 3.8.20
From 3.9 up to and including 3.9.18
From 4.0 up to and including 4.0.17
From 4.1 up to and including 4.1.17
From 4.2 up to and including 4.2.14
From 4.3 up to and including 4.3.10
From 4.4 up to and including 4.4.9
From 4.5 up to and including 4.5.8
From 4.6 up to and including 4.6.5
From 4.7 up to and including 4.7.4

Fixed in

3.7.21, 3.8.21, 3.9.19, 4.0.18, 4.1.18, 4.2.15, 4.3.11, 4.4.10, 4.5.9, 4.6.6, 4.7.5

What to do

If your site has an affected version, update WordPress to version 4.7.5 or newer.

Official ID

CVE-2017-9063

Report title

WordPress Core < 4.7.5 - Cross-Site Scripting via Customizer

First reported

16 May 2017

Sources

Wordfence, seen 16 May 2017

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.20; from 3.8 up to and including 3.8.20; from 3.9 up to and including 3.9.18; from 4.0 up to and including 4.0.17; from 4.1 up to and including 4.1.17; from 4.2 up to and including 4.2.14; from 4.3 up to and including 4.3.10; from 4.4 up to and including 4.4.9; from 4.5 up to and including 4.5.8; from 4.6 up to and including 4.6.5; from 4.7 up to and including 4.7.4) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.20
From 3.8 up to and including 3.8.20
From 3.9 up to and including 3.9.18
From 4.0 up to and including 4.0.17
From 4.1 up to and including 4.1.17
From 4.2 up to and including 4.2.14
From 4.3 up to and including 4.3.10
From 4.4 up to and including 4.4.9
From 4.5 up to and including 4.5.8
From 4.6 up to and including 4.6.5
From 4.7 up to and including 4.7.4

Fixed in

3.7.21, 3.8.21, 3.9.19, 4.0.18, 4.1.18, 4.2.15, 4.3.11, 4.4.10, 4.5.9, 4.6.6, 4.7.5

What to do

If your site has an affected version, update WordPress to version 4.7.5 or newer.

Official ID

CVE-2017-9062

Report title

WordPress Core < 4.7.5 - Mishandling Post Meta Values via XML-RPC

First reported

16 May 2017

Sources

Wordfence, seen 16 May 2017

This week

Someone could use it to harm your site (before 5.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 5.5

Fixed in

5.5

What to do

If your site has an affected version, update WordPress to version 5.5 or newer.

Official ID

CVE-2017-8295

Report title

Wordpress Core < 5.5 - Unauthorized Password Reset via Interception

First reported

3 May 2017

Sources

Wordfence, seen 3 May 2017

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.18; from 3.8 up to and including 3.8.18; from 3.9 up to and including 3.9.16; from 4.0 up to and including 4.0.15; from 4.1 up to and including 4.1.15; from 4.2 up to and including 4.2.12; from 4.3 up to and including 4.3.8; from 4.4 up to and including 4.4.7; from 4.5 up to and including 4.5.6; from 4.6 up to and including 4.6.3; from 4.7 up to and including 4.7.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.18
From 3.8 up to and including 3.8.18
From 3.9 up to and including 3.9.16
From 4.0 up to and including 4.0.15
From 4.1 up to and including 4.1.15
From 4.2 up to and including 4.2.12
From 4.3 up to and including 4.3.8
From 4.4 up to and including 4.4.7
From 4.5 up to and including 4.5.6
From 4.6 up to and including 4.6.3
From 4.7 up to and including 4.7.2

Fixed in

3.7.19, 3.8.19, 3.9.17, 4.0.16, 4.1.16, 4.2.13, 4.3.9, 4.4.8, 4.5.7, 4.6.4, 4.7.3

What to do

If your site has an affected version, update WordPress to version 4.7.3 or newer.

Official ID

CVE-2017-6817

Report title

WordPress Core < 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds

First reported

6 March 2017

Sources

Wordfence, seen 6 March 2017

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.18; from 3.8 up to and including 3.8.18; from 3.9 up to and including 3.9.16; from 4.0 up to and including 4.0.15; from 4.1 up to and including 4.1.15; from 4.2 up to and including 4.2.12; from 4.3 up to and including 4.3.8; from 4.4 up to and including 4.4.7; from 4.5 up to and including 4.5.6; from 4.6 up to and including 4.6.3; from 4.7 up to and including 4.7.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.18
From 3.8 up to and including 3.8.18
From 3.9 up to and including 3.9.16
From 4.0 up to and including 4.0.15
From 4.1 up to and including 4.1.15
From 4.2 up to and including 4.2.12
From 4.3 up to and including 4.3.8
From 4.4 up to and including 4.4.7
From 4.5 up to and including 4.5.6
From 4.6 up to and including 4.6.3
From 4.7 up to and including 4.7.2

Fixed in

3.7.19, 3.8.19, 3.9.17, 4.0.16, 4.1.16, 4.2.13, 4.3.9, 4.4.8, 4.5.7, 4.6.4, 4.7.3

What to do

If your site has an affected version, update WordPress to version 4.7.3 or newer.

Official ID

CVE-2017-6815

Report title

WordPress Core < 4.7.3 - Bypass URL Validation

First reported

6 March 2017

Sources

Wordfence, seen 6 March 2017

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.18; from 3.8 up to and including 3.8.18; from 3.9 up to and including 3.9.16; from 4.0 up to and including 4.0.15; from 4.1 up to and including 4.1.15; from 4.2 up to and including 4.2.12; from 4.3 up to and including 4.3.8; from 4.4 up to and including 4.4.7; from 4.5 up to and including 4.5.6; from 4.6 up to and including 4.6.3; from 4.7 up to and including 4.7.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.18
From 3.8 up to and including 3.8.18
From 3.9 up to and including 3.9.16
From 4.0 up to and including 4.0.15
From 4.1 up to and including 4.1.15
From 4.2 up to and including 4.2.12
From 4.3 up to and including 4.3.8
From 4.4 up to and including 4.4.7
From 4.5 up to and including 4.5.6
From 4.6 up to and including 4.6.3
From 4.7 up to and including 4.7.2

Fixed in

3.7.19, 3.8.19, 3.9.17, 4.0.16, 4.1.16, 4.2.13, 4.3.9, 4.4.8, 4.5.7, 4.6.4, 4.7.3

What to do

If your site has an affected version, update WordPress to version 4.7.3 or newer.

Official ID

CVE-2017-6814

Report title

WordPress Core < 4.7.3 - Cross-Site Scripting via Media Metadata

First reported

6 March 2017

Sources

Wordfence, seen 6 March 2017

This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.7; from 3.7 up to and including 3.7.18; from 3.8 up to and including 3.8.18; from 3.9 up to and including 3.9.16; from 4.0 up to and including 4.0.15; from 4.1 up to and including 4.1.15; from 4.2 up to and including 4.2.12; from 4.3 up to and including 4.3.8; from 4.4 up to and including 4.4.7; from 4.5 up to and including 4.5.6; from 4.6 up to and including 4.6.3; from 4.7 up to and including 4.7.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.18
From 3.8 up to and including 3.8.18
From 3.9 up to and including 3.9.16
From 4.0 up to and including 4.0.15
From 4.1 up to and including 4.1.15
From 4.2 up to and including 4.2.12
From 4.3 up to and including 4.3.8
From 4.4 up to and including 4.4.7
From 4.5 up to and including 4.5.6
From 4.6 up to and including 4.6.3
From 4.7 up to and including 4.7.2

Fixed in

3.7.19, 3.8.19, 3.9.17, 4.0.16, 4.1.16, 4.2.13, 4.3.9, 4.4.8, 4.5.7, 4.6.4, 4.7.3

What to do

If your site has an affected version, update WordPress to version 4.7.3 or newer.

Official ID

CVE-2017-6819

Report title

WordPress Core < 4.7.3 - Cross-Site Request Forgery via Press This

First reported

6 March 2017

Sources

Wordfence, seen 6 March 2017

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.18; from 3.8 up to and including 3.8.18; from 3.9 up to and including 3.9.16; from 4.0 up to and including 4.0.15; from 4.1 up to and including 4.1.15; from 4.2 up to and including 4.2.12; from 4.3 up to and including 4.3.8; from 4.4 up to and including 4.4.7; from 4.5 up to and including 4.5.6; from 4.6 up to and including 4.6.3; from 4.7 up to and including 4.7.2) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.18
From 3.8 up to and including 3.8.18
From 3.9 up to and including 3.9.16
From 4.0 up to and including 4.0.15
From 4.1 up to and including 4.1.15
From 4.2 up to and including 4.2.12
From 4.3 up to and including 4.3.8
From 4.4 up to and including 4.4.7
From 4.5 up to and including 4.5.6
From 4.6 up to and including 4.6.3
From 4.7 up to and including 4.7.2

Fixed in

3.7.19, 3.8.19, 3.9.17, 4.0.16, 4.1.16, 4.2.13, 4.3.9, 4.4.8, 4.5.7, 4.6.4, 4.7.3

What to do

If your site has an affected version, update WordPress to version 4.7.3 or newer.

Official ID

CVE-2017-6818

Report title

WordPress Core < 4.7.3 - Cross-Site Scripting via Taxonomy names

First reported

6 March 2017

Sources

Wordfence, seen 6 March 2017

This week

Someone could read or delete private files on your server (before 3.7; from 3.7 up to and including 3.7.18; from 3.8 up to and including 3.8.18; from 3.9 up to and including 3.9.16; from 4.0 up to and including 4.0.15; from 4.1 up to and including 4.1.15; from 4.2 up to and including 4.2.12; from 4.3 up to and including 4.3.8; from 4.4 up to and including 4.4.7; from 4.5 up to and including 4.5.6; from 4.6 up to and including 4.6.3; from 4.7 up to and including 4.7.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.18
From 3.8 up to and including 3.8.18
From 3.9 up to and including 3.9.16
From 4.0 up to and including 4.0.15
From 4.1 up to and including 4.1.15
From 4.2 up to and including 4.2.12
From 4.3 up to and including 4.3.8
From 4.4 up to and including 4.4.7
From 4.5 up to and including 4.5.6
From 4.6 up to and including 4.6.3
From 4.7 up to and including 4.7.2

Fixed in

3.7.19, 3.8.19, 3.9.17, 4.0.16, 4.1.16, 4.2.13, 4.3.9, 4.4.8, 4.5.7, 4.6.4, 4.7.3

What to do

If your site has an affected version, update WordPress to version 4.7.3 or newer.

Official ID

CVE-2017-6816

Report title

WordPress Core < 4.7.3 - Arbitrary File Deletion

First reported

6 March 2017

Sources

Wordfence, seen 6 March 2017

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.17; from 3.8 up to and including 3.8.17; from 3.9 up to and including 3.9.15; from 4.0 up to and including 4.0.14; from 4.1 up to and including 4.1.14; from 4.2 up to and including 4.2.11; from 4.3 up to and including 4.3.7; from 4.4 up to and including 4.4.6; from 4.5 up to and including 4.5.5; from 4.6 up to and including 4.6.2; from 4.7 up to and including 4.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.17
From 3.8 up to and including 3.8.17
From 3.9 up to and including 3.9.15
From 4.0 up to and including 4.0.14
From 4.1 up to and including 4.1.14
From 4.2 up to and including 4.2.11
From 4.3 up to and including 4.3.7
From 4.4 up to and including 4.4.6
From 4.5 up to and including 4.5.5
From 4.6 up to and including 4.6.2
From 4.7 up to and including 4.7.1

Fixed in

3.7.18, 3.8.18, 3.9.16, 4.0.15, 4.1.15, 4.2.12, 4.3.8, 4.4.7, 4.5.6, 4.6.3, 4.7.2

What to do

If your site has an affected version, update WordPress to version 4.7.2 or newer.

Official ID

CVE-2017-1001000

Report title

WordPress Core < 4.7.2 - Arbitrary Page Modification

First reported

26 January 2017

Sources

Wordfence, seen 26 January 2017

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.17; from 3.8 up to and including 3.8.17; from 3.9 up to and including 3.9.15; from 4.0 up to and including 4.0.14; from 4.1 up to and including 4.1.14; from 4.2 up to and including 4.2.11; from 4.3 up to and including 4.3.7; from 4.4 up to and including 4.4.6; from 4.5 up to and including 4.5.5; from 4.6 up to and including 4.6.2; from 4.7 up to and including 4.7.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.17
From 3.8 up to and including 3.8.17
From 3.9 up to and including 3.9.15
From 4.0 up to and including 4.0.14
From 4.1 up to and including 4.1.14
From 4.2 up to and including 4.2.11
From 4.3 up to and including 4.3.7
From 4.4 up to and including 4.4.6
From 4.5 up to and including 4.5.5
From 4.6 up to and including 4.6.2
From 4.7 up to and including 4.7.1

Fixed in

3.7.18, 3.8.18, 3.9.16, 4.0.15, 4.1.15, 4.2.12, 4.3.8, 4.4.7, 4.5.6, 4.6.3, 4.7.2

What to do

If your site has an affected version, update WordPress to version 4.7.2 or newer.

Official ID

CVE-2017-5610

Report title

WordPress Core < 4.7.2 - Authorization Bypass to Term Disclosure

First reported

26 January 2017

Sources

Wordfence, seen 26 January 2017

This week

Someone could read or change the data in your site’s database (before 3.7; from 3.7 up to and including 3.7.17; from 3.8 up to and including 3.8.17; from 3.9 up to and including 3.9.15; from 4.0 up to and including 4.0.14; from 4.1 up to and including 4.1.14; from 4.2 up to and including 4.2.11; from 4.3 up to and including 4.3.7; from 4.4 up to and including 4.4.6; from 4.5 up to and including 4.5.5; from 4.6 up to and including 4.6.2; from 4.7 up to and including 4.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.17
From 3.8 up to and including 3.8.17
From 3.9 up to and including 3.9.15
From 4.0 up to and including 4.0.14
From 4.1 up to and including 4.1.14
From 4.2 up to and including 4.2.11
From 4.3 up to and including 4.3.7
From 4.4 up to and including 4.4.6
From 4.5 up to and including 4.5.5
From 4.6 up to and including 4.6.2
From 4.7 up to and including 4.7.1

Fixed in

3.7.18, 3.8.18, 3.9.16, 4.0.15, 4.1.15, 4.2.12, 4.3.8, 4.4.7, 4.5.6, 4.6.3, 4.7.2

What to do

If your site has an affected version, update WordPress to version 4.7.2 or newer.

Official ID

CVE-2017-5611

Report title

WordPress Core < 4.7.2 - Authenticated SQL Injection

First reported

26 January 2017

Sources

Wordfence, seen 26 January 2017

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.17; from 3.8 up to and including 3.8.17; from 3.9 up to and including 3.9.15; from 4.0 up to and including 4.0.14; from 4.1 up to and including 4.1.14; from 4.2 up to and including 4.2.11; from 4.3 up to and including 4.3.7; from 4.4 up to and including 4.4.6; from 4.5 up to and including 4.5.5; from 4.6 up to and including 4.6.2; from 4.7 up to and including 4.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.17
From 3.8 up to and including 3.8.17
From 3.9 up to and including 3.9.15
From 4.0 up to and including 4.0.14
From 4.1 up to and including 4.1.14
From 4.2 up to and including 4.2.11
From 4.3 up to and including 4.3.7
From 4.4 up to and including 4.4.6
From 4.5 up to and including 4.5.5
From 4.6 up to and including 4.6.2
From 4.7 up to and including 4.7.1

Fixed in

3.7.18, 3.8.18, 3.9.16, 4.0.15, 4.1.15, 4.2.12, 4.3.8, 4.4.7, 4.5.6, 4.6.3, 4.7.2

What to do

If your site has an affected version, update WordPress to version 4.7.2 or newer.

Official ID

CVE-2017-5612

Report title

WordPress Core < 4.7.2 - Cross-Site Scripting

First reported

26 January 2017

Sources

Wordfence, seen 26 January 2017

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.16; from 3.8 up to and including 3.8.16; from 3.9 up to and including 3.9.14; from 4.0 up to and including 4.0.13; from 4.1 up to and including 4.1.13; from 4.2 up to and including 4.2.10; from 4.3 up to and including 4.3.6; from 4.4 up to and including 4.4.5; from 4.5 up to and including 4.5.4; from 4.6 up to and including 4.6.1; from 4.7 up to and including 4.7.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.16
From 3.8 up to and including 3.8.16
From 3.9 up to and including 3.9.14
From 4.0 up to and including 4.0.13
From 4.1 up to and including 4.1.13
From 4.2 up to and including 4.2.10
From 4.3 up to and including 4.3.6
From 4.4 up to and including 4.4.5
From 4.5 up to and including 4.5.4
From 4.6 up to and including 4.6.1
From 4.7 up to and including 4.7.0

Fixed in

3.7.17, 3.8.17, 3.9.15, 4.0.14, 4.1.14, 4.2.11, 4.3.7, 4.4.6, 4.5.5, 4.6.2, 4.7.1

What to do

If your site has an affected version, update WordPress to version 4.7.1 or newer.

Official ID

CVE-2017-5493

Report title

WordPress Core < 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup

First reported

11 January 2017

Sources

Wordfence, seen 11 January 2017

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.16; from 3.8 up to and including 3.8.16; from 3.9 up to and including 3.9.14; from 4.0 up to and including 4.0.13; from 4.1 up to and including 4.1.13; from 4.2 up to and including 4.2.10; from 4.3 up to and including 4.3.6; from 4.4 up to and including 4.4.5; from 4.5 up to and including 4.5.4; from 4.6 up to and including 4.6.1; from 4.7 up to and including 4.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.16
From 3.8 up to and including 3.8.16
From 3.9 up to and including 3.9.14
From 4.0 up to and including 4.0.13
From 4.1 up to and including 4.1.13
From 4.2 up to and including 4.2.10
From 4.3 up to and including 4.3.6
From 4.4 up to and including 4.4.5
From 4.5 up to and including 4.5.4
From 4.6 up to and including 4.6.1
From 4.7 up to and including 4.7

Fixed in

3.7.17, 3.8.17, 3.9.15, 4.0.14, 4.1.14, 4.2.11, 4.3.7, 4.4.6, 4.5.5, 4.6.2, 4.7.1

What to do

If your site has an affected version, update WordPress to version 4.7.1 or newer.

Official ID

CVE-2017-5487

Report title

WordPress Core < 4.7.1 - Information Disclosure

First reported

11 January 2017

Sources

Wordfence, seen 11 January 2017

This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.7; from 3.7 up to and including 3.7.16; from 3.8 up to and including 3.8.16; from 3.9 up to and including 3.9.14; from 4.0 up to and including 4.0.13; from 4.1 up to and including 4.1.13; from 4.2 up to and including 4.2.10; from 4.3 up to and including 4.3.6; from 4.4 up to and including 4.4.5; from 4.5 up to and including 4.5.4; from 4.6 up to and including 4.6.1; from 4.7 up to and including 4.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.16
From 3.8 up to and including 3.8.16
From 3.9 up to and including 3.9.14
From 4.0 up to and including 4.0.13
From 4.1 up to and including 4.1.13
From 4.2 up to and including 4.2.10
From 4.3 up to and including 4.3.6
From 4.4 up to and including 4.4.5
From 4.5 up to and including 4.5.4
From 4.6 up to and including 4.6.1
From 4.7 up to and including 4.7

Fixed in

3.7.17, 3.8.17, 3.9.15, 4.0.14, 4.1.14, 4.2.11, 4.3.7, 4.4.6, 4.5.5, 4.6.2, 4.7.1

What to do

If your site has an affected version, update WordPress to version 4.7.1 or newer.

Official ID

CVE-2017-5492

Report title

WordPress Core < 4.7.1 - Cross-Site Request Forgery via Widget Editing

First reported

11 January 2017

Sources

Wordfence, seen 11 January 2017

This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.7; from 3.7 up to and including 3.7.16; from 3.8 up to and including 3.8.16; from 3.9 up to and including 3.9.14; from 4.0 up to and including 4.0.13; from 4.1 up to and including 4.1.13; from 4.2 up to and including 4.2.10; from 4.3 up to and including 4.3.6; from 4.4 up to and including 4.4.5; from 4.5 up to and including 4.5.4; from 4.6 up to and including 4.6.1; from 4.7 up to and including 4.7.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.16
From 3.8 up to and including 3.8.16
From 3.9 up to and including 3.9.14
From 4.0 up to and including 4.0.13
From 4.1 up to and including 4.1.13
From 4.2 up to and including 4.2.10
From 4.3 up to and including 4.3.6
From 4.4 up to and including 4.4.5
From 4.5 up to and including 4.5.4
From 4.6 up to and including 4.6.1
From 4.7 up to and including 4.7.0

Fixed in

3.7.17, 3.8.17, 3.9.15, 4.0.14, 4.1.14, 4.2.11, 4.3.7, 4.4.6, 4.5.5, 4.6.2, 4.7.1

What to do

If your site has an affected version, update WordPress to version 4.7.1 or newer.

Official ID

CVE-2017-5489

Report title

WordPress Core < 4.7.1 - Cross-Site Request Forgery via Uploading Flash File

First reported

11 January 2017

Sources

Wordfence, seen 11 January 2017

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.16; from 3.8 up to and including 3.8.16; from 3.9 up to and including 3.9.14; from 4.0 up to and including 4.0.13; from 4.1 up to and including 4.1.13; from 4.2 up to and including 4.2.10; from 4.3 up to and including 4.3.6; from 4.4 up to and including 4.4.5; from 4.5 up to and including 4.5.4; from 4.6 up to and including 4.6.1; from 4.7 up to and including 4.7.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.16
From 3.8 up to and including 3.8.16
From 3.9 up to and including 3.9.14
From 4.0 up to and including 4.0.13
From 4.1 up to and including 4.1.13
From 4.2 up to and including 4.2.10
From 4.3 up to and including 4.3.6
From 4.4 up to and including 4.4.5
From 4.5 up to and including 4.5.4
From 4.6 up to and including 4.6.1
From 4.7 up to and including 4.7.0

Fixed in

3.7.17, 3.8.17, 3.9.15, 4.0.14, 4.1.14, 4.2.11, 4.3.7, 4.4.6, 4.5.5, 4.6.2, 4.7.1

What to do

If your site has an affected version, update WordPress to version 4.7.1 or newer.

Official ID

CVE-2017-5490

Report title

WordPress Core < 4.7.1 - Stored Cross-Site Scripting via theme directory name

First reported

11 January 2017

Sources

Wordfence, seen 11 January 2017

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.16; from 3.8 up to and including 3.8.16; from 3.9 up to and including 3.9.14; from 4.0 up to and including 4.0.13; from 4.1 up to and including 4.1.13; from 4.2 up to and including 4.2.10; from 4.3 up to and including 4.3.6; from 4.4 up to and including 4.4.5; from 4.5 up to and including 4.5.4; from 4.6 up to and including 4.6.1; from 4.7 up to and including 4.7.0) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.16
From 3.8 up to and including 3.8.16
From 3.9 up to and including 3.9.14
From 4.0 up to and including 4.0.13
From 4.1 up to and including 4.1.13
From 4.2 up to and including 4.2.10
From 4.3 up to and including 4.3.6
From 4.4 up to and including 4.4.5
From 4.5 up to and including 4.5.4
From 4.6 up to and including 4.6.1
From 4.7 up to and including 4.7.0

Fixed in

3.7.17, 3.8.17, 3.9.15, 4.0.14, 4.1.14, 4.2.11, 4.3.7, 4.4.6, 4.5.5, 4.6.2, 4.7.1

What to do

If your site has an affected version, update WordPress to version 4.7.1 or newer.

Official ID

CVE-2017-5488

Report title

WordPress Core < 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin

First reported

11 January 2017

Sources

Wordfence, seen 11 January 2017

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.16; from 3.8 up to and including 3.8.16; from 3.9 up to and including 3.9.14; from 4.0 up to and including 4.0.13; from 4.1 up to and including 4.1.13; from 4.2 up to and including 4.2.10; from 4.3 up to and including 4.3.6; from 4.4 up to and including 4.4.5; from 4.5 up to and including 4.5.4; from 4.6 up to and including 4.6.1; from 4.7 up to and including 4.7.0) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.16
From 3.8 up to and including 3.8.16
From 3.9 up to and including 3.9.14
From 4.0 up to and including 4.0.13
From 4.1 up to and including 4.1.13
From 4.2 up to and including 4.2.10
From 4.3 up to and including 4.3.6
From 4.4 up to and including 4.4.5
From 4.5 up to and including 4.5.4
From 4.6 up to and including 4.6.1
From 4.7 up to and including 4.7.0

Fixed in

3.7.17, 3.8.17, 3.9.15, 4.0.14, 4.1.14, 4.2.11, 4.3.7, 4.4.6, 4.5.5, 4.6.2, 4.7.1

What to do

If your site has an affected version, update WordPress to version 4.7.1 or newer.

Official ID

CVE-2017-5491

Report title

WordPress Core < 4.7.1 - Authorization Bypass

First reported

11 January 2017

Sources

Wordfence, seen 11 January 2017

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.17; from 3.8 up to and including 3.8.17; from 3.9 up to and including 3.9.15; from 4.0 up to and including 4.0.14; from 4.1 up to and including 4.1.14; from 4.2 up to and including 4.2.11; from 4.3 up to and including 4.3.7; from 4.4 up to and including 4.4.6; from 4.5 up to and including 4.5.5; from 4.6 up to and including 4.6.2; from 4.7 up to and including 4.7.1) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.17
From 3.8 up to and including 3.8.17
From 3.9 up to and including 3.9.15
From 4.0 up to and including 4.0.14
From 4.1 up to and including 4.1.14
From 4.2 up to and including 4.2.11
From 4.3 up to and including 4.3.7
From 4.4 up to and including 4.4.6
From 4.5 up to and including 4.5.5
From 4.6 up to and including 4.6.2
From 4.7 up to and including 4.7.1

Fixed in

3.7.18, 3.8.18, 3.9.16, 4.0.15, 4.1.15, 4.2.12, 4.3.8, 4.4.7, 4.5.6, 4.6.3, 4.7.2

What to do

If your site has an affected version, update WordPress to version 4.7.2 or newer.

Official ID

CVE-2017-6514

Report title

WordPress Core < 4.7.2 - Path Disclosure

First reported

1 January 2017

Sources

Wordfence, seen 1 January 2017

This week

Someone could make your server visit other addresses on their behalf (before 4.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.5

Fixed in

4.5

What to do

If your site has an affected version, update WordPress to version 4.5 or newer.

Official ID

CVE-2016-4029

Report title

WordPress Core < 4.5 - Server-Side Request Forgery

First reported

29 September 2016

Sources

Wordfence, seen 29 September 2016

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.15; from 3.8 up to and including 3.8.15; from 3.9 up to and including 3.9.13; from 4.0 up to and including 4.0.12; from 4.1 up to and including 4.1.12; from 4.2 up to and including 4.2.9; from 4.3 up to and including 4.3.5; from 4.4 up to and including 4.4.4; from 4.5 up to and including 4.5.3; from 4.6 up to and including 4.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.15
From 3.8 up to and including 3.8.15
From 3.9 up to and including 3.9.13
From 4.0 up to and including 4.0.12
From 4.1 up to and including 4.1.12
From 4.2 up to and including 4.2.9
From 4.3 up to and including 4.3.5
From 4.4 up to and including 4.4.4
From 4.5 up to and including 4.5.3
From 4.6 up to and including 4.6

Fixed in

3.7.16, 3.8.16, 3.9.14, 4.0.13, 4.1.13, 4.2.10, 4.3.6, 4.4.5, 4.5.4, 4.6.1

What to do

If your site has an affected version, update WordPress to version 4.6.1 or newer.

Official ID

CVE-2016-7169

Report title

WordPress Core < 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access

First reported

7 September 2016

Sources

Wordfence, seen 7 September 2016

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.15; from 3.8 up to and including 3.8.15; from 3.9 up to and including 3.9.13; from 4.0 up to and including 4.0.12; from 4.1 up to and including 4.1.12; from 4.2 up to and including 4.2.9; from 4.3 up to and including 4.3.5; from 4.4 up to and including 4.4.4; from 4.5 up to and including 4.5.3; from 4.6 up to and including 4.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.15
From 3.8 up to and including 3.8.15
From 3.9 up to and including 3.9.13
From 4.0 up to and including 4.0.12
From 4.1 up to and including 4.1.12
From 4.2 up to and including 4.2.9
From 4.3 up to and including 4.3.5
From 4.4 up to and including 4.4.4
From 4.5 up to and including 4.5.3
From 4.6 up to and including 4.6

Fixed in

3.7.16, 3.8.16, 3.9.14, 4.0.13, 4.1.13, 4.2.10, 4.3.6, 4.4.5, 4.5.4, 4.6.1

What to do

If your site has an affected version, update WordPress to version 4.6.1 or newer.

Official ID

CVE-2016-7168

Report title

WordPress Core < 4.6.1 - Authenticated Stored Cross-Site Scripting

First reported

7 September 2016

Sources

Wordfence, seen 7 September 2016

This week

Someone could slow down or crash your site (before 4.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.6

Fixed in

4.6

What to do

If your site has an affected version, update WordPress to version 4.6 or newer.

Official ID

CVE-2016-6896

Report title

WordPress Core <= 4.5.3 - Denial of Service

First reported

22 August 2016

Sources

Wordfence, seen 22 August 2016

This week

Someone could trick a logged-in admin into changing settings without knowing (before 4.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.6

Fixed in

4.6

What to do

If your site has an affected version, update WordPress to version 4.6 or newer.

Official ID

CVE-2016-6897

Report title

WordPress Core < 4.6 - Cross-Site Request Forgery

First reported

16 August 2016

Sources

Wordfence, seen 16 August 2016

This week

Someone could use it to harm your site (before 4.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.6

Fixed in

4.6

What to do

If your site has an affected version, update WordPress to version 4.6 or newer.

Official ID

CVE-2016-10148

Report title

WordPress Core < 4.6 - Authorization Bypass

First reported

16 August 2016

Sources

Wordfence, seen 16 August 2016

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.14; from 3.8 up to and including 3.8.14; from 3.9 up to and including 3.9.12; from 4.0 up to and including 4.0.11; from 4.1 up to and including 4.1.11; from 4.2 up to and including 4.2.8; from 4.3 up to and including 4.3.4; from 4.4 up to and including 4.4.3; from 4.5 up to and including 4.5.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.14
From 3.8 up to and including 3.8.14
From 3.9 up to and including 3.9.12
From 4.0 up to and including 4.0.11
From 4.1 up to and including 4.1.11
From 4.2 up to and including 4.2.8
From 4.3 up to and including 4.3.4
From 4.4 up to and including 4.4.3
From 4.5 up to and including 4.5.2

Fixed in

3.7.15, 3.8.15, 3.9.13, 4.0.12, 4.1.12, 4.2.9, 4.3.5, 4.4.4, 4.5.3

What to do

If your site has an affected version, update WordPress to version 4.5.3 or newer.

Official ID

CVE-2016-5835

Report title

WordPress Core < 4.5.3 - Revision History Disclosure

First reported

18 June 2016

Sources

Wordfence, seen 18 June 2016

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.14; from 3.8 up to and including 3.8.14; from 3.9 up to and including 3.9.12; from 4.0 up to and including 4.0.11; from 4.1 up to and including 4.1.11; from 4.2 up to and including 4.2.8; from 4.3 up to and including 4.3.4; from 4.4 up to and including 4.4.3; from 4.5 up to and including 4.5.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.14
From 3.8 up to and including 3.8.14
From 3.9 up to and including 3.9.12
From 4.0 up to and including 4.0.11
From 4.1 up to and including 4.1.11
From 4.2 up to and including 4.2.8
From 4.3 up to and including 4.3.4
From 4.4 up to and including 4.4.3
From 4.5 up to and including 4.5.2

Fixed in

3.7.15, 3.8.15, 3.9.13, 4.0.12, 4.1.12, 4.2.9, 4.3.5, 4.4.4, 4.5.3

What to do

If your site has an affected version, update WordPress to version 4.5.3 or newer.

Official ID

CVE-2016-5832

Report title

WordPress Core < 4.5.3 - Cross-Site Scripting via Customizer

First reported

18 June 2016

Sources

Wordfence, seen 18 June 2016

This week

Someone could slow down or crash your site (before 3.7; from 3.7 up to and including 3.7.14; from 3.8 up to and including 3.8.14; from 3.9 up to and including 3.9.12; from 4.0 up to and including 4.0.11; from 4.1 up to and including 4.1.11; from 4.2 up to and including 4.2.8; from 4.3 up to and including 4.3.4; from 4.4 up to and including 4.4.3; from 4.5 up to and including 4.5.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.14
From 3.8 up to and including 3.8.14
From 3.9 up to and including 3.9.12
From 4.0 up to and including 4.0.11
From 4.1 up to and including 4.1.11
From 4.2 up to and including 4.2.8
From 4.3 up to and including 4.3.4
From 4.4 up to and including 4.4.3
From 4.5 up to and including 4.5.2

Fixed in

3.7.15, 3.8.15, 3.9.13, 4.0.12, 4.1.12, 4.2.9, 4.3.5, 4.4.4, 4.5.3

What to do

If your site has an affected version, update WordPress to version 4.5.3 or newer.

Official ID

CVE-2016-5836

Report title

WordPress Core < 4.5.3 - Denial of Service via oEmbed Protocol

First reported

18 June 2016

Sources

Wordfence, seen 18 June 2016

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.14; from 3.8 up to and including 3.8.14; from 3.9 up to and including 3.9.12; from 4.0 up to and including 4.0.11; from 4.1 up to and including 4.1.11; from 4.2 up to and including 4.2.8; from 4.3 up to and including 4.3.4; from 4.4 up to and including 4.4.3; from 4.5 up to and including 4.5.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.14
From 3.8 up to and including 3.8.14
From 3.9 up to and including 3.9.12
From 4.0 up to and including 4.0.11
From 4.1 up to and including 4.1.11
From 4.2 up to and including 4.2.8
From 4.3 up to and including 4.3.4
From 4.4 up to and including 4.4.3
From 4.5 up to and including 4.5.2

Fixed in

3.7.15, 3.8.15, 3.9.13, 4.0.12, 4.1.12, 4.2.9, 4.3.5, 4.4.4, 4.5.3

What to do

If your site has an affected version, update WordPress to version 4.5.3 or newer.

Official ID

CVE-2016-5839

Report title

WordPress Core < 4.5.3 - Bypass sanitize_file_name Protection

First reported

18 June 2016

Sources

Wordfence, seen 18 June 2016

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.14; from 3.8 up to and including 3.8.14; from 3.9 up to and including 3.9.12; from 4.0 up to and including 4.0.11; from 4.1 up to and including 4.1.11; from 4.2 up to and including 4.2.8; from 4.3 up to and including 4.3.4; from 4.4 up to and including 4.4.3; from 4.5 up to and including 4.5.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.14
From 3.8 up to and including 3.8.14
From 3.9 up to and including 3.9.12
From 4.0 up to and including 4.0.11
From 4.1 up to and including 4.1.11
From 4.2 up to and including 4.2.8
From 4.3 up to and including 4.3.4
From 4.4 up to and including 4.4.3
From 4.5 up to and including 4.5.2

Fixed in

3.7.15, 3.8.15, 3.9.13, 4.0.12, 4.1.12, 4.2.9, 4.3.5, 4.4.4, 4.5.3

What to do

If your site has an affected version, update WordPress to version 4.5.3 or newer.

Official ID

CVE-2016-5834

Report title

WordPress Core < 4.5.3 - Cross-Site Scripting via Attachment Name

First reported

18 June 2016

Sources

Wordfence, seen 18 June 2016

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.14; from 3.8 up to and including 3.8.14; from 3.9 up to and including 3.9.12; from 4.0 up to and including 4.0.11; from 4.1 up to and including 4.1.11; from 4.2 up to and including 4.2.8; from 4.3 up to and including 4.3.4; from 4.4 up to and including 4.4.3; from 4.5 up to and including 4.5.2) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.14
From 3.8 up to and including 3.8.14
From 3.9 up to and including 3.9.12
From 4.0 up to and including 4.0.11
From 4.1 up to and including 4.1.11
From 4.2 up to and including 4.2.8
From 4.3 up to and including 4.3.4
From 4.4 up to and including 4.4.3
From 4.5 up to and including 4.5.2

Fixed in

3.7.15, 3.8.15, 3.9.13, 4.0.12, 4.1.12, 4.2.9, 4.3.5, 4.4.4, 4.5.3

What to do

If your site has an affected version, update WordPress to version 4.5.3 or newer.

Official ID

CVE-2016-5837

Report title

WordPress Core < 4.5.3 - Authorization Bypass to Remove Category Attribute

First reported

18 June 2016

Sources

Wordfence, seen 18 June 2016

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.14; from 3.8 up to and including 3.8.14; from 3.9 up to and including 3.9.12; from 4.0 up to and including 4.0.11; from 4.1 up to and including 4.1.11; from 4.2 up to and including 4.2.8; from 4.3 up to and including 4.3.4; from 4.4 up to and including 4.4.3; from 4.5 up to and including 4.5.2) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.14
From 3.8 up to and including 3.8.14
From 3.9 up to and including 3.9.12
From 4.0 up to and including 4.0.11
From 4.1 up to and including 4.1.11
From 4.2 up to and including 4.2.8
From 4.3 up to and including 4.3.4
From 4.4 up to and including 4.4.3
From 4.5 up to and including 4.5.2

Fixed in

3.7.15, 3.8.15, 3.9.13, 4.0.12, 4.1.12, 4.2.9, 4.3.5, 4.4.4, 4.5.3

What to do

If your site has an affected version, update WordPress to version 4.5.3 or newer.

Official ID

CVE-2016-5838

Report title

WordPress Core < 4.5.3 - Password Change via Stolen Cookie

First reported

18 June 2016

Sources

Wordfence, seen 18 June 2016

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.14; from 3.8 up to and including 3.8.14; from 3.9 up to and including 3.9.12; from 4.0 up to and including 4.0.11; from 4.1 up to and including 4.1.11; from 4.2 up to and including 4.2.8; from 4.3 up to and including 4.3.4; from 4.4 up to and including 4.4.3; from 4.5 up to and including 4.5.2) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.14
From 3.8 up to and including 3.8.14
From 3.9 up to and including 3.9.12
From 4.0 up to and including 4.0.11
From 4.1 up to and including 4.1.11
From 4.2 up to and including 4.2.8
From 4.3 up to and including 4.3.4
From 4.4 up to and including 4.4.3
From 4.5 up to and including 4.5.2

Fixed in

3.7.15, 3.8.15, 3.9.13, 4.0.12, 4.1.12, 4.2.9, 4.3.5, 4.4.4, 4.5.3

What to do

If your site has an affected version, update WordPress to version 4.5.3 or newer.

Official ID

CVE-2016-5833

Report title

WordPress Core < 4.5.3 - Cross-Site Scripting via Attachment Name #2

First reported

18 June 2016

Sources

Wordfence, seen 18 June 2016

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.13; from 3.8 up to and including 3.8.13; from 3.9 up to and including 3.9.11; from 4.0 up to and including 4.0.10; from 4.1 up to and including 4.1.10; from 4.2 up to and including 4.2.7; from 4.3 up to and including 4.3.3; from 4.4 up to and including 4.4.2; from 4.5 up to and including 4.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.13
From 3.8 up to and including 3.8.13
From 3.9 up to and including 3.9.11
From 4.0 up to and including 4.0.10
From 4.1 up to and including 4.1.10
From 4.2 up to and including 4.2.7
From 4.3 up to and including 4.3.3
From 4.4 up to and including 4.4.2
From 4.5 up to and including 4.5.1

Fixed in

3.7.14, 3.8.14, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.4, 4.4.3, 4.5.2

What to do

If your site has an affected version, update WordPress to version 4.5.2 or newer.

Official ID

CVE-2016-4567

Report title

WordPress Core < 4.5.2 - Cross-Site Scripting via MediaElement.js

First reported

6 May 2016

Sources

Wordfence, seen 6 May 2016

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.13; from 3.8 up to and including 3.8.13; from 3.9 up to and including 3.9.11; from 4.0 up to and including 4.0.10; from 4.1 up to and including 4.1.10; from 4.2 up to and including 4.2.7; from 4.3 up to and including 4.3.3; from 4.4 up to and including 4.4.2; from 4.5 up to and including 4.5.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.13
From 3.8 up to and including 3.8.13
From 3.9 up to and including 3.9.11
From 4.0 up to and including 4.0.10
From 4.1 up to and including 4.1.10
From 4.2 up to and including 4.2.7
From 4.3 up to and including 4.3.3
From 4.4 up to and including 4.4.2
From 4.5 up to and including 4.5.1

Fixed in

3.7.14, 3.8.14, 3.9.12, 4.0.11, 4.1.11, 4.2.8, 4.3.4, 4.4.3, 4.5.2

What to do

If your site has an affected version, update WordPress to version 4.5.2 or newer.

Official ID

CVE-2016-4566

Report title

WordPress Core < 4.5.2 - Cross-Site Scripting via plupload.flash.swf

First reported

6 May 2016

Sources

Wordfence, seen 6 May 2016

This week

Someone could plant harmful code that runs for your visitors or admins (before 4.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.5

Fixed in

4.5

What to do

If your site has an affected version, update WordPress to version 4.5 or newer.

Official ID

CVE-2016-6634

Report title

WordPress Core < 4.5 - Cross-Site Scripting via Network Settings Page

First reported

12 April 2016

Sources

Wordfence, seen 12 April 2016

This week

Someone could trick a logged-in admin into changing settings without knowing (before 4.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.5

Fixed in

4.5

What to do

If your site has an affected version, update WordPress to version 4.5 or newer.

Official ID

CVE-2016-6635

Report title

WordPress Core < 4.5 - Cross-Site Request Forgery via wp_ajax_wp_compression_test

First reported

12 March 2016

Sources

Wordfence, seen 12 March 2016

This week

Someone could make your server visit other addresses on their behalf (before 3.7; from 3.7 up to and including 3.7.12; from 3.8 up to and including 3.8.12; from 3.9 up to and including 3.9.10; from 4.0 up to and including 4.0.9; from 4.1 up to and including 4.1.9; from 4.2 up to and including 4.2.6; from 4.3 up to and including 4.3.2; from 4.4 up to and including 4.4.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.12
From 3.8 up to and including 3.8.12
From 3.9 up to and including 3.9.10
From 4.0 up to and including 4.0.9
From 4.1 up to and including 4.1.9
From 4.2 up to and including 4.2.6
From 4.3 up to and including 4.3.2
From 4.4 up to and including 4.4.1

Fixed in

3.7.13, 3.8.13, 3.9.11, 4.0.10, 4.1.10, 4.2.7, 4.3.3, 4.4.2

What to do

If your site has an affected version, update WordPress to version 4.4.2 or newer.

Official ID

CVE-2016-2222

Report title

WordPress Core < 4.4.2 - Server-Side Request Forgery

First reported

2 February 2016

Sources

Wordfence, seen 2 February 2016

This week

Someone could send your visitors from your site to a harmful site (before 3.7; from 3.7 up to and including 3.7.12; from 3.8 up to and including 3.8.12; from 3.9 up to and including 3.9.10; from 4.0 up to and including 4.0.9; from 4.1 up to and including 4.1.9; from 4.2 up to and including 4.2.6; from 4.3 up to and including 4.3.2; from 4.4 up to and including 4.4.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.12
From 3.8 up to and including 3.8.12
From 3.9 up to and including 3.9.10
From 4.0 up to and including 4.0.9
From 4.1 up to and including 4.1.9
From 4.2 up to and including 4.2.6
From 4.3 up to and including 4.3.2
From 4.4 up to and including 4.4.1

Fixed in

3.7.13, 3.8.13, 3.9.11, 4.0.10, 4.1.10, 4.2.7, 4.3.3, 4.4.2

What to do

If your site has an affected version, update WordPress to version 4.4.2 or newer.

Official ID

CVE-2016-2221

Report title

WordPress Core < 4.4.2 - Open Redirect via wp_validate_redirect

First reported

2 February 2016

Sources

Wordfence, seen 2 February 2016

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.11; from 3.8 up to and including 3.8.11; from 3.9 up to and including 3.9.9; from 4.0 up to and including 4.0.8; from 4.1 up to and including 4.1.8; from 4.2 up to and including 4.2.5; from 4.3 up to and including 4.3.1; from 4.4 up to and including 4.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.11
From 3.8 up to and including 3.8.11
From 3.9 up to and including 3.9.9
From 4.0 up to and including 4.0.8
From 4.1 up to and including 4.1.8
From 4.2 up to and including 4.2.5
From 4.3 up to and including 4.3.1
From 4.4 up to and including 4.4

Fixed in

3.7.12, 3.8.12, 3.9.10, 4.0.9, 4.1.9, 4.2.6, 4.3.2, 4.4.1

What to do

If your site has an affected version, update WordPress to version 4.4.1 or newer.

Official ID

CVE-2016-1564

Report title

WordPress Core < 4.4.1 - Cross-Site Scripting via Theme Names

First reported

16 January 2016

Sources

Wordfence, seen 16 January 2016

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.10; from 3.8 up to and including 3.8.10; from 3.9 up to and including 3.9.8; from 4.0 up to and including 4.0.7; from 4.1 up to and including 4.1.7; from 4.2 up to and including 4.2.4; from 4.3 up to and including 4.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.10
From 3.8 up to and including 3.8.10
From 3.9 up to and including 3.9.8
From 4.0 up to and including 4.0.7
From 4.1 up to and including 4.1.7
From 4.2 up to and including 4.2.4
From 4.3 up to and including 4.3

Fixed in

3.7.11, 3.8.11, 3.9.9, 4.0.8, 4.1.8, 4.2.5, 4.3.1

What to do

If your site has an affected version, update WordPress to version 4.3.1 or newer.

Official ID

CVE-2015-7989

Report title

WordPress Core < 4.3.1 - Authenticated Cross-Site Scripting

First reported

15 September 2015

Sources

Wordfence, seen 15 September 2015

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.10; from 3.8 up to and including 3.8.10; from 3.9 up to and including 3.9.8; from 4.0 up to and including 4.0.7; from 4.1 up to and including 4.1.7; from 4.2 up to and including 4.2.4; from 4.3 up to and including 4.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.10
From 3.8 up to and including 3.8.10
From 3.9 up to and including 3.9.8
From 4.0 up to and including 4.0.7
From 4.1 up to and including 4.1.7
From 4.2 up to and including 4.2.4
From 4.3 up to and including 4.3

Fixed in

3.7.11, 3.8.11, 3.9.9, 4.0.8, 4.1.8, 4.2.5, 4.3.1

What to do

If your site has an affected version, update WordPress to version 4.3.1 or newer.

Official ID

CVE-2015-5715

Report title

WordPress Core < 4.3.1 - Authorization Bypass to Information Disclosure

First reported

15 September 2015

Sources

Wordfence, seen 15 September 2015

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.10; from 3.8 up to and including 3.8.10; from 3.9 up to and including 3.9.8; from 4.0 up to and including 4.0.7; from 4.1 up to and including 4.1.7; from 4.2 up to and including 4.2.4; from 4.3 up to and including 4.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.10
From 3.8 up to and including 3.8.10
From 3.9 up to and including 3.9.8
From 4.0 up to and including 4.0.7
From 4.1 up to and including 4.1.7
From 4.2 up to and including 4.2.4
From 4.3 up to and including 4.3

Fixed in

3.7.11, 3.8.11, 3.9.9, 4.0.8, 4.1.8, 4.2.5, 4.3.1

What to do

If your site has an affected version, update WordPress to version 4.3.1 or newer.

Official ID

CVE-2015-5714

Report title

WordPress Core < 4.3.1 - Cross-Site Scripting via Shortcodes

First reported

15 September 2015

Sources

Wordfence, seen 15 September 2015

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.9; from 3.8 up to and including 3.8.9; from 3.9 up to and including 3.9.7; from 4.0 up to and including 4.0.6; from 4.1 up to and including 4.1.6; from 4.2 up to and including 4.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.9
From 3.8 up to and including 3.8.9
From 3.9 up to and including 3.9.7
From 4.0 up to and including 4.0.6
From 4.1 up to and including 4.1.6
From 4.2 up to and including 4.2.3

Fixed in

3.7.10, 3.8.10, 3.9.8, 4.0.7, 4.1.7, 4.2.4

What to do

If your site has an affected version, update WordPress to version 4.2.4 or newer.

Official ID

CVE-2015-5733

Report title

WordPress Core < 4.2.4 - Stored Cross-Site Scripting via accessibility-helper Title

First reported

4 August 2015

Sources

Wordfence, seen 4 August 2015

This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.7; from 3.7 up to and including 3.7.9; from 3.8 up to and including 3.8.9; from 3.9 up to and including 3.9.7; from 4.0 up to and including 4.0.6; from 4.1 up to and including 4.1.6; from 4.2 up to and including 4.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.9
From 3.8 up to and including 3.8.9
From 3.9 up to and including 3.9.7
From 4.0 up to and including 4.0.6
From 4.1 up to and including 4.1.6
From 4.2 up to and including 4.2.3

Fixed in

3.7.10, 3.8.10, 3.9.8, 4.0.7, 4.1.7, 4.2.4

What to do

If your site has an affected version, update WordPress to version 4.2.4 or newer.

Official ID

CVE-2015-5731

Report title

WordPress Core < 4.2.4 - Cross-Site Request Forgery to Post Lockage

First reported

4 August 2015

Sources

Wordfence, seen 4 August 2015

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.9; from 3.8 up to and including 3.8.9; from 3.9 up to and including 3.9.7; from 4.0 up to and including 4.0.6; from 4.1 up to and including 4.1.6; from 4.2 up to and including 4.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.9
From 3.8 up to and including 3.8.9
From 3.9 up to and including 3.9.7
From 4.0 up to and including 4.0.6
From 4.1 up to and including 4.1.6
From 4.2 up to and including 4.2.3

Fixed in

3.7.10, 3.8.10, 3.9.8, 4.0.7, 4.1.7, 4.2.4

What to do

If your site has an affected version, update WordPress to version 4.2.4 or newer.

Official ID

CVE-2015-5730

Report title

WordPress Core < 4.2.4 - Timing Side-Channel Attack

First reported

4 August 2015

Sources

Wordfence, seen 4 August 2015

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.9; from 3.8 up to and including 3.8.9; from 3.9 up to and including 3.9.7; from 4.0 up to and including 4.0.6; from 4.1 up to and including 4.1.6; from 4.2 up to and including 4.2.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.9
From 3.8 up to and including 3.8.9
From 3.9 up to and including 3.9.7
From 4.0 up to and including 4.0.6
From 4.1 up to and including 4.1.6
From 4.2 up to and including 4.2.3

Fixed in

3.7.10, 3.8.10, 3.9.8, 4.0.7, 4.1.7, 4.2.4

What to do

If your site has an affected version, update WordPress to version 4.2.4 or newer.

Official ID

CVE-2015-5732

Report title

WordPress Core < 4.2.4 - Cross-Site Scripting via Widget Title

First reported

4 August 2015

Sources

Wordfence, seen 4 August 2015

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.9; from 3.8 up to and including 3.8.9; from 3.9 up to and including 3.9.7; from 4.0 up to and including 4.0.6; from 4.1 up to and including 4.1.6; from 4.2 up to and including 4.2.3) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.9
From 3.8 up to and including 3.8.9
From 3.9 up to and including 3.9.7
From 4.0 up to and including 4.0.6
From 4.1 up to and including 4.1.6
From 4.2 up to and including 4.2.3

Fixed in

3.7.10, 3.8.10, 3.9.8, 4.0.7, 4.1.7, 4.2.4

What to do

If your site has an affected version, update WordPress to version 4.2.4 or newer.

Official ID

CVE-2015-5734

Report title

WordPress Core < 4.2.4 - Cross-Site Scripting in Theme Preview

First reported

4 August 2015

Sources

Wordfence, seen 4 August 2015

This week

Someone could read or change the data in your site’s database (before 3.7; from 3.7 up to and including 3.7.9; from 3.8 up to and including 3.8.9; from 3.9 up to and including 3.9.7; from 4.0 up to and including 4.0.6; from 4.1 up to and including 4.1.6; from 4.2 up to and including 4.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.9
From 3.8 up to and including 3.8.9
From 3.9 up to and including 3.9.7
From 4.0 up to and including 4.0.6
From 4.1 up to and including 4.1.6
From 4.2 up to and including 4.2.3

Fixed in

3.7.10, 3.8.10, 3.9.8, 4.0.7, 4.1.7, 4.2.4

What to do

If your site has an affected version, update WordPress to version 4.2.4 or newer.

Official ID

CVE-2015-2213

Report title

WordPress Core < 4.2.4 - SQL Injection

First reported

4 August 2015

Sources

Wordfence, seen 4 August 2015

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.8; from 3.8 up to and including 3.8.8; from 3.9 up to and including 3.9.6; from 4.0 up to and including 4.0.5; from 4.1 up to and including 4.1.5; from 4.2 up to and including 4.2.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.8
From 3.8 up to and including 3.8.8
From 3.9 up to and including 3.9.6
From 4.0 up to and including 4.0.5
From 4.1 up to and including 4.1.5
From 4.2 up to and including 4.2.2

Fixed in

3.7.9, 3.8.9, 3.9.7, 4.0.6, 4.1.6, 4.2.3

What to do

If your site has an affected version, update WordPress to version 4.2.3 or newer.

Official ID

CVE-2015-5622

Report title

WordPress Core < 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

First reported

23 July 2015

Sources

Wordfence, seen 23 July 2015

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.8; from 3.8 up to and including 3.8.8; from 3.9 up to and including 3.9.6; from 4.0 up to and including 4.0.5; from 4.1 up to and including 4.1.5; from 4.2 up to and including 4.2.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.8
From 3.8 up to and including 3.8.8
From 3.9 up to and including 3.9.6
From 4.0 up to and including 4.0.5
From 4.1 up to and including 4.1.5
From 4.2 up to and including 4.2.2

Fixed in

3.7.9, 3.8.9, 3.9.7, 4.0.6, 4.1.6, 4.2.3

What to do

If your site has an affected version, update WordPress to version 4.2.3 or newer.

Official ID

CVE-2015-5623

Report title

WordPress Core < 4.2.3 - Authorization Bypass

First reported

23 July 2015

Sources

Wordfence, seen 23 July 2015

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.7; from 3.8 up to and including 3.8.7; from 3.9 up to and including 3.9.5; from 4.0 up to and including 4.0.4; from 4.1 up to and including 4.1.4; from 4.2 up to and including 4.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.7
From 3.8 up to and including 3.8.7
From 3.9 up to and including 3.9.5
From 4.0 up to and including 4.0.4
From 4.1 up to and including 4.1.4
From 4.2 up to and including 4.2.1

Fixed in

3.7.8, 3.8.8, 3.9.6, 4.0.5, 4.1.5, 4.2.2

What to do

If your site has an affected version, update WordPress to version 4.2.2 or newer.

Official ID

CVE-2015-8834

Report title

WordPress Core < 4.2.2 - Cross-Site Scripting via Comments

First reported

7 May 2015

Sources

Wordfence, seen 7 May 2015

This week

Someone could plant harmful code that runs for your visitors or admins (from 4.0 up to and including 4.0.3; from 4.1 up to and including 4.1.3; from 4.2 up to and including 4.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 4.0 up to and including 4.0.3
From 4.1 up to and including 4.1.3
From 4.2 up to and including 4.2

Fixed in

4.0.4, 4.1.4, 4.2.1

What to do

If your site has an affected version, update WordPress to version 4.2.1 or newer.

Official ID

CVE-2015-3440

Report title

WordPress Core < 4.2.1 - Cross-Site Scripting via Comments

First reported

27 April 2015

Sources

Wordfence, seen 27 April 2015

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.5; from 3.8 up to and including 3.8.5; from 3.9 up to and including 3.9.3; from 4.0 up to and including 4.0.1; from 4.1 up to and including 4.1.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.5
From 3.8 up to and including 3.8.5
From 3.9 up to and including 3.9.3
From 4.0 up to and including 4.0.1
From 4.1 up to and including 4.1.1

Fixed in

3.7.6, 3.8.6, 3.9.4, 4.0.2, 4.1.2

What to do

If your site has an affected version, update WordPress to version 4.1.2 or newer.

Official ID

CVE-2015-3438

Report title

WordPress Core < 4.1.2 - Cross-Site Scripting

First reported

21 April 2015

Sources

Wordfence, seen 21 April 2015

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.5; from 3.8 up to and including 3.8.5; from 3.9 up to and including 3.9.3; from 4.0 up to and including 4.0.1; from 4.1 up to and including 4.1.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.5
From 3.8 up to and including 3.8.5
From 3.9 up to and including 3.9.3
From 4.0 up to and including 4.0.1
From 4.1 up to and including 4.1.1

Fixed in

3.7.6, 3.8.6, 3.9.4, 4.0.2, 4.1.2

What to do

If your site has an affected version, update WordPress to version 4.1.2 or newer.

Official ID

CVE-2015-3439

Report title

WordPress Core < 4.1.2 - Cross-Site Scripting via Ephox in Plupload

First reported

20 April 2015

Sources

Wordfence, seen 20 April 2015

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.7; from 3.8 up to and including 3.8.7; from 3.9 up to and including 3.9.5; from 4.0 up to and including 4.0.4; from 4.1 up to and including 4.1.4; from 4.2 up to and including 4.2.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.7
From 3.8 up to and including 3.8.7
From 3.9 up to and including 3.9.5
From 4.0 up to and including 4.0.4
From 4.1 up to and including 4.1.4
From 4.2 up to and including 4.2.1

Fixed in

3.7.8, 3.8.8, 3.9.6, 4.0.5, 4.1.5, 4.2.2

What to do

If your site has an affected version, update WordPress to version 4.2.2 or newer.

Official ID

CVE-2015-3429

Report title

Twenty Fifteen Theme <= 1.1 & WordPress Core < 4.2.2 - Cross-Site Scripting via example.html

First reported

8 April 2015

Sources

Wordfence, seen 8 April 2015

This week

Someone could use it to harm your site (before 4.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.4

Fixed in

4.4

What to do

If your site has an affected version, update WordPress to version 4.4 or newer.

Official ID

CVE-2014-6412

Report title

WordPress Core < 4.4 - Brute Force Password Recovery Tokens

First reported

12 February 2015

Sources

Wordfence, seen 12 February 2015

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.6.1; from 3.7 up to and including 3.7.4; from 3.8 up to and including 3.8.4; from 3.9 up to and including 3.9.2; from 4.0 up to and including 4.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6.1
From 3.7 up to and including 3.7.4
From 3.8 up to and including 3.8.4
From 3.9 up to and including 3.9.2
From 4.0 up to and including 4.0

Fixed in

3.7.5, 3.8.5, 3.9.3, 4.0.1

What to do

If your site has an affected version, update WordPress to version 4.0.1 or newer.

Official ID

CVE-2014-9036

Report title

WordPress Core < 4.0.1 - Cross-Site Scripting via CSS

First reported

20 November 2014

Sources

Wordfence, seen 20 November 2014

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.4; from 3.8 up to and including 3.8.4; from 3.9 up to and including 3.9.2; from 4.0 up to and including 4.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.4
From 3.8 up to and including 3.8.4
From 3.9 up to and including 3.9.2
From 4.0 up to and including 4.0

Fixed in

3.7.5, 3.8.5, 3.9.3, 4.0.1

What to do

If your site has an affected version, update WordPress to version 4.0.1 or newer.

Official ID

CVE-2014-9037

Report title

Wordpress Core < 4.0.1 - Hash Collision

First reported

20 November 2014

Sources

Wordfence, seen 20 November 2014

This week

Someone could make your server visit other addresses on their behalf (before 3.7; from 3.7 up to and including 3.7.4; from 3.8 up to and including 3.8.4; from 3.9 up to and including 3.9.2; from 4.0 up to and including 4.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.4
From 3.8 up to and including 3.8.4
From 3.9 up to and including 3.9.2
From 4.0 up to and including 4.0

Fixed in

3.7.5, 3.8.5, 3.9.3, 4.0.1

What to do

If your site has an affected version, update WordPress to version 4.0.1 or newer.

Official ID

CVE-2014-9038

Report title

WordPress Core < 4.0.1 - Server-Side Request Forgery

First reported

20 November 2014

Sources

Wordfence, seen 20 November 2014

This week

Someone could slow down or crash your site (before 3.7; from 3.7 up to and including 3.7.4; from 3.8 up to and including 3.8.4; from 3.9 up to and including 3.9.2; from 4.0 up to and including 4.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.4
From 3.8 up to and including 3.8.4
From 3.9 up to and including 3.9.2
From 4.0 up to and including 4.0

Fixed in

3.7.5, 3.8.5, 3.9.3, 4.0.1

What to do

If your site has an affected version, update WordPress to version 4.0.1 or newer.

Official ID

CVE-2014-9034

Report title

WordPress Core < 4.0.1 - Denial of Service via Long Password

First reported

20 November 2014

Sources

Wordfence, seen 20 November 2014

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.4; from 3.8 up to and including 3.8.4; from 3.9 up to and including 3.9.2; from 4.0 up to and including 4.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.4
From 3.8 up to and including 3.8.4
From 3.9 up to and including 3.9.2
From 4.0 up to and including 4.0

Fixed in

3.7.5, 3.8.5, 3.9.3, 4.0.1

What to do

If your site has an affected version, update WordPress to version 4.0.1 or newer.

Official ID

CVE-2014-9031

Report title

WordPress Core < 4.0.1 - Cross-Site Scripting via Shortcode Brackets

First reported

20 November 2014

Sources

Wordfence, seen 20 November 2014

This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.7; from 3.7 up to and including 3.7.4; from 3.8 up to and including 3.8.4; from 3.9 up to and including 3.9.2; from 4.0 up to and including 4.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.4
From 3.8 up to and including 3.8.4
From 3.9 up to and including 3.9.2
From 4.0 up to and including 4.0

Fixed in

3.7.5, 3.8.5, 3.9.3, 4.0.1

What to do

If your site has an affected version, update WordPress to version 4.0.1 or newer.

Official ID

CVE-2014-9039

Report title

WordPress Core < 4.0.1 Cross-Site Request Forgery to Password Reset

First reported

20 November 2014

Sources

Wordfence, seen 20 November 2014

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.4; from 3.8 up to and including 3.8.4; from 3.9 up to and including 3.9.2; from 4.0 up to and including 4.0) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.4
From 3.8 up to and including 3.8.4
From 3.9 up to and including 3.9.2
From 4.0 up to and including 4.0

Fixed in

3.7.5, 3.8.5, 3.9.3, 4.0.1

What to do

If your site has an affected version, update WordPress to version 4.0.1 or newer.

Official ID

CVE-2014-9035

Report title

WordPress Core < 4.0.1 - Cross-Site Scripting

First reported

20 November 2014

Sources

Wordfence, seen 20 November 2014

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.4; from 3.8 up to and including 3.8.4; from 3.9 up to and including 3.9.2; from 4.0 up to and including 4.0) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.4
From 3.8 up to and including 3.8.4
From 3.9 up to and including 3.9.2
From 4.0 up to and including 4.0

Fixed in

3.7.5, 3.8.5, 3.9.3, 4.0.1

What to do

If your site has an affected version, update WordPress to version 4.0.1 or newer.

Official ID

CVE-2014-9032

Report title

WordPress Core < 4.0.1 - Cross-Site Scripting via media-playlists

First reported

20 November 2014

Sources

Wordfence, seen 20 November 2014

This week

Someone could use it to harm your site (before 3.9.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.9.2

Fixed in

3.9.2

What to do

If your site has an affected version, update WordPress to version 3.9.2 or newer.

Official ID

CVE-2014-2053

Report title

WordPress Core <= 3.9.1 - XML External Entity (XXE) Weakness

First reported

6 August 2014

Sources

Wordfence, seen 6 August 2014

This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.7; from 3.7 up to and including 3.7.3; from 3.8 up to and including 3.8.3; from 3.9 up to and including 3.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.3
From 3.8 up to and including 3.8.3
From 3.9 up to and including 3.9.1

Fixed in

3.7.4, 3.8.4, 3.9.2

What to do

If your site has an affected version, update WordPress to version 3.9.2 or newer.

Official ID

CVE-2014-5204

Report title

WordPress Core < 3.9.2 - Cross-Site Request Forgery Protection Bypass

First reported

6 August 2014

Sources

Wordfence, seen 6 August 2014

This week

Someone could slow down or crash your site (before 3.7; from 3.7 up to and including 3.7.3; from 3.8 up to and including 3.8.3; from 3.9 up to and including 3.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.3
From 3.8 up to and including 3.8.3
From 3.9 up to and including 3.9.1

Fixed in

3.7.4, 3.8.4, 3.9.2

What to do

If your site has an affected version, update WordPress to version 3.9.2 or newer.

Official ID

CVE-2014-5265

Report title

WordPress Core < 3.9.2 - Denial of Service via XML

First reported

6 August 2014

Sources

Wordfence, seen 6 August 2014

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.7; from 3.7 up to and including 3.7.3; from 3.8 up to and including 3.8.3; from 3.9 up to and including 3.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.3
From 3.8 up to and including 3.8.3
From 3.9 up to and including 3.9.1

Fixed in

3.7.4, 3.8.4, 3.9.2

What to do

If your site has an affected version, update WordPress to version 3.9.2 or newer.

Official ID

CVE-2014-5240

Report title

WordPress Core < 3.9.2 - Authenticated Cross-Site Scripting via Avatar URL

First reported

6 August 2014

Sources

Wordfence, seen 6 August 2014

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.3; from 3.8 up to and including 3.8.3; from 3.9 up to and including 3.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.3
From 3.8 up to and including 3.8.3
From 3.9 up to and including 3.9.1

Fixed in

3.7.4, 3.8.4, 3.9.2

What to do

If your site has an affected version, update WordPress to version 3.9.2 or newer.

Official ID

CVE-2014-5203

Report title

WordPress Core < 3.9.2 - Deserialization via Widgets

First reported

6 August 2014

Sources

Wordfence, seen 6 August 2014

This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.7; from 3.7 up to and including 3.7.3; from 3.8 up to and including 3.8.3; from 3.9 up to and including 3.9.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.3
From 3.8 up to and including 3.8.3
From 3.9 up to and including 3.9.1

Fixed in

3.7.4, 3.8.4, 3.9.2

What to do

If your site has an affected version, update WordPress to version 3.9.2 or newer.

Official ID

CVE-2014-5205

Report title

WordPress Core < 3.9.2 - Brute Force of Cross-Site Request Forgery Tokens

First reported

6 August 2014

Sources

Wordfence, seen 6 August 2014

This week

Someone could slow down or crash your site (before 3.7; from 3.7 up to and including 3.7.3; from 3.8 up to and including 3.8.3; from 3.9 up to and including 3.9.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.3
From 3.8 up to and including 3.8.3
From 3.9 up to and including 3.9.1

Fixed in

3.7.4, 3.8.4, 3.9.2

What to do

If your site has an affected version, update WordPress to version 3.9.2 or newer.

Official ID

CVE-2014-5266

Report title

WordPress Core < 3.9.2 - Denial of Service via XML #2

First reported

6 August 2014

Sources

Wordfence, seen 6 August 2014

This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.7; from 3.7 up to and including 3.7.3; from 3.8 up to and including 3.8.3; from 3.9 up to and including 3.9.1) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.3
From 3.8 up to and including 3.8.3
From 3.9 up to and including 3.9.1

Fixed in

3.7.4, 3.8.4, 3.9.2

What to do

If your site has an affected version, update WordPress to version 3.9.2 or newer.

Official ID

CVE-2014-9033

Report title

WordPress Core < 4.0.1 - Cross-Site Request Forgery to Authentication Takeover

First reported

6 August 2014

Sources

Wordfence, seen 6 August 2014

This week

Someone could read or change the data in your site’s database (from 3.8.1 up to and including 3.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 3.8.1 up to and including 3.8.1

Fixed in

3.8.2

What to do

If your site has an affected version, update WordPress to version 3.8.2 or newer.

Report title

WordPress Core < 3.8.2 - SQL Injection

First reported

9 April 2014

Sources

Wordfence, seen 9 April 2014

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.1; from 3.8 up to and including 3.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.1
From 3.8 up to and including 3.8.1

Fixed in

3.7.2, 3.8.2

What to do

If your site has an affected version, update WordPress to version 3.8.2 or newer.

Official ID

CVE-2014-0165

Report title

WordPress Core < 3.8.2 - Contributor Users Can Publish Posts

First reported

8 April 2014

Sources

Wordfence, seen 8 April 2014

This week

Someone could use it to harm your site (before 3.7; from 3.7 up to and including 3.7.1; from 3.8 up to and including 3.8.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.7
From 3.7 up to and including 3.7.1
From 3.8 up to and including 3.8.1

Fixed in

3.7.2, 3.8.2

What to do

If your site has an affected version, update WordPress to version 3.8.2 or newer.

Official ID

CVE-2014-0166

Report title

WordPress Core < 3.8.2 - Authentication Cookie Forgery

First reported

8 April 2014

Sources

Wordfence, seen 8 April 2014

This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.0.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.11

Fixed in

2.1

What to do

If your site has an affected version, update WordPress to version 2.1 or newer.

Official ID

CVE-2013-7233

Report title

WordPress Core < 2.1 - Cross-Site Request Forgery to Denial of Service

First reported

17 December 2013

Sources

Wordfence, seen 17 December 2013

This week

Someone could send your visitors from your site to a harmful site (up to and including 3.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6

Fixed in

3.6.1

What to do

If your site has an affected version, update WordPress to version 3.6.1 or newer.

Official ID

CVE-2013-4339

Report title

WordPress Core < 3.6.1 - Open Redirect

First reported

11 September 2013

Sources

Wordfence, seen 11 September 2013

This week

Someone could use it to harm your site (up to and including 3.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6

Fixed in

3.6.1

What to do

If your site has an affected version, update WordPress to version 3.6.1 or newer.

Official ID

CVE-2013-5738

Report title

WordPress Core < 3.6.1 - HTML File Upload

First reported

11 September 2013

Sources

Wordfence, seen 11 September 2013

This week

Someone could use it to harm your site (before 3.6.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.6.1

Fixed in

3.6.1

What to do

If your site has an affected version, update WordPress to version 3.6.1 or newer.

Official ID

CVE-2013-5739

Report title

WordPress Core < 3.6.1 - .swf and .exe File Upload

First reported

11 September 2013

Sources

Wordfence, seen 11 September 2013

This week

Someone could use it to harm your site (up to and including 3.6) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6

Fixed in

3.6.1

What to do

If your site has an affected version, update WordPress to version 3.6.1 or newer.

Official ID

CVE-2013-4340

Report title

WordPress Core < 3.6.1 - Spoof Post Authorship

First reported

11 September 2013

Sources

Wordfence, seen 11 September 2013

This week

Someone could use it to harm your site (up to and including 3.6) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.6

Fixed in

3.6.1

What to do

If your site has an affected version, update WordPress to version 3.6.1 or newer.

Official ID

CVE-2013-4338

Report title

WordPress Core < 3.6.1 - Deserialization

First reported

11 September 2013

Sources

Wordfence, seen 11 September 2013

This week

Someone could use it to harm your site (up to and including 3.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.5.1

Fixed in

3.5.2

What to do

If your site has an affected version, update WordPress to version 3.5.2 or newer.

Official ID

CVE-2013-2202

Report title

WordPress Core < 3.5.2 - XXE Injection

First reported

21 June 2013

Sources

Wordfence, seen 21 June 2013

This week

Someone could use it to harm your site (up to and including 3.5.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.5.1

Fixed in

3.5.2

What to do

If your site has an affected version, update WordPress to version 3.5.2 or newer.

Official ID

CVE-2013-2204

Report title

WordPress Core <= 3.5.1 - Content-Spoofing Attacks

First reported

21 June 2013

Sources

Wordfence, seen 21 June 2013

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.5.1

Fixed in

3.5.2

What to do

If your site has an affected version, update WordPress to version 3.5.2 or newer.

Official ID

CVE-2013-2201

Report title

WordPress Core < 3.5.2 - Cross-Site Scripting via Multiple Vectors

First reported

21 June 2013

Sources

Wordfence, seen 21 June 2013

This week

Someone could use it to harm your site (up to and including 3.5.1) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.5.1

Fixed in

3.5.2

What to do

If your site has an affected version, update WordPress to version 3.5.2 or newer.

Official ID

CVE-2013-2199

Report title

WordPress Core < 3.5.2 - Server Side Request Forgery

First reported

21 June 2013

Sources

Wordfence, seen 21 June 2013

This week

Someone could slow down or crash your site (before 3.5.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.5.2

Fixed in

3.5.2

What to do

If your site has an affected version, update WordPress to version 3.5.2 or newer.

Official ID

CVE-2013-2173

Report title

WordPress Core <= 3.5.1 - Denial of Service via wp-postpass cookie

First reported

21 June 2013

Sources

Wordfence, seen 21 June 2013

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.5.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.5.1

Fixed in

3.5.2

What to do

If your site has an affected version, update WordPress to version 3.5.2 or newer.

Official ID

CVE-2013-2205

Report title

WordPress Core < 3.5.2 - Cross-Site Scripting

First reported

21 June 2013

Sources

Wordfence, seen 21 June 2013

This week

Someone could use it to harm your site (up to and including 3.5.1) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.5.1

Fixed in

3.5.2

What to do

If your site has an affected version, update WordPress to version 3.5.2 or newer.

Official ID

CVE-2013-2203

Report title

WordPress Core < 3.5.2 - Sensitive Information Disclosure

First reported

21 June 2013

Sources

Wordfence, seen 21 June 2013

This week

Someone could do things on your site they should not be allowed to (up to and including 3.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.5.1

Fixed in

3.5.2

What to do

If your site has an affected version, update WordPress to version 3.5.2 or newer.

Official ID

CVE-2013-2200

Report title

WordPress Core < 3.5.2 - Missing Authorization Checks

First reported

21 June 2013

Sources

Wordfence, seen 21 June 2013

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.5.1

Fixed in

3.5.1

What to do

If your site has an affected version, update WordPress to version 3.5.1 or newer.

Official ID

CVE-2013-0236

Report title

WordPress Core < 3.5.1 - Stored Cross-Site Scripting

First reported

24 January 2013

Sources

Wordfence, seen 24 January 2013

This week

Someone could make your server visit other addresses on their behalf (up to and including 3.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.5

Fixed in

3.5.1

What to do

If your site has an affected version, update WordPress to version 3.5.1 or newer.

Official ID

CVE-2013-0235

Report title

WordPress Core < 3.5.1 - Server-Side Request Forgery

First reported

24 January 2013

Sources

Wordfence, seen 24 January 2013

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.5

Fixed in

3.5.1

What to do

If your site has an affected version, update WordPress to version 3.5.1 or newer.

Official ID

CVE-2013-0237

Report title

WordPress Core < 3.5.1 - Cross-Site Scripting

First reported

24 January 2013

Sources

Wordfence, seen 24 January 2013

This week

Someone could use it to harm your site (before 4.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 4.0

Fixed in

4.0

What to do

If your site has an affected version, update WordPress to version 4.0 or newer.

Official ID

CVE-2012-5868

Report title

WordPress Core < 4.0 - Missing Session Cookie Expiration

First reported

27 December 2012

Sources

Wordfence, seen 27 December 2012

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.3.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.3.2

Fixed in

3.3.2

What to do

If your site has an affected version, update WordPress to version 3.3.2 or newer.

Official ID

CVE-2012-3414

Report title

SWFUpload <= 2.2.0.1 - Cross-Site Scripting

First reported

9 November 2012

Sources

Wordfence, seen 9 November 2012

This week

Someone could do things on your site they should not be allowed to (before 3.4.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.4.2

Fixed in

3.4.2

What to do

If your site has an affected version, update WordPress to version 3.4.2 or newer.

Official ID

CVE-2012-4421

Report title

WordPress Core < 3.4.2 - Missing Authorization Checks on create_post

First reported

6 September 2012

Sources

Wordfence, seen 6 September 2012

This week

Someone could do things on your site they should not be allowed to (up to and including 3.4.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.4.1

Fixed in

3.4.2

What to do

If your site has an affected version, update WordPress to version 3.4.2 or newer.

Official ID

CVE-2012-4422

Report title

WordPress Core < 3.4.2 - Missing Authorization Checks

First reported

6 September 2012

Sources

Wordfence, seen 6 September 2012

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.4.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.4.1

Fixed in

3.4.2

What to do

If your site has an affected version, update WordPress to version 3.4.2 or newer.

Official ID

CVE-2012-3383

Report title

WordPress Core < 3.4.2 - Cross-Site Scripting

First reported

6 September 2012

Sources

Wordfence, seen 6 September 2012

This week

Someone could use it to harm your site (before 3.3.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.3.3

Fixed in

3.3.3

What to do

If your site has an affected version, update WordPress to version 3.3.3 or newer.

Official ID

CVE-2012-6635

Report title

WordPress Core <= 3.3.2 - Sensitive Information Disclosure

First reported

27 June 2012

Sources

Wordfence, seen 27 June 2012

This week

Someone could use it to harm your site (before 3.3.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.3.3

Fixed in

3.3.3

What to do

If your site has an affected version, update WordPress to version 3.3.3 or newer.

Official ID

CVE-2012-6634

Report title

WordPress Core <= 3.3.2 - Sensitive Information Disclosure

First reported

27 June 2012

Sources

Wordfence, seen 27 June 2012

This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.4

Fixed in

3.4.1

What to do

If your site has an affected version, update WordPress to version 3.4.1 or newer.

Official ID

CVE-2012-3384

Report title

WordPress Core < 3.4.1 - Cross-Site Request Forgery

First reported

27 June 2012

Sources

Wordfence, seen 27 June 2012

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.3.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.3.3

Fixed in

3.3.3

What to do

If your site has an affected version, update WordPress to version 3.3.3 or newer.

Official ID

CVE-2012-6633

Report title

WordPress Core <= 3.3.2 - Cross-Site Scripting

First reported

27 June 2012

Sources

Wordfence, seen 27 June 2012

This week

Someone could use it to harm your site (up to and including 3.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.4

Fixed in

3.4.1

What to do

If your site has an affected version, update WordPress to version 3.4.1 or newer.

Official ID

CVE-2012-3385

Report title

WordPress Core < 3.4.1 - Information Disclosure

First reported

27 June 2012

Sources

Wordfence, seen 27 June 2012

This week

Someone could use it to harm your site (before 6.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 6.8

Fixed in

6.8

What to do

If your site has an affected version, update WordPress to version 6.8 or newer.

Official ID

CVE-2012-6707

Report title

WordPress Core - Informational < 6.8 - Weak Hashing Algorithm

First reported

20 June 2012

Sources

Wordfence, seen 20 June 2012

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.3.1

Fixed in

3.3.2

What to do

If your site has an affected version, update WordPress to version 3.3.2 or newer.

Official ID

CVE-2012-2404

Report title

WordPress Core <= 3.3.1 - Cross-Site Scripting

First reported

21 April 2012

Sources

Wordfence, seen 21 April 2012

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.5.1) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.5.1

Fixed in

3.5.2

What to do

If your site has an affected version, update WordPress to version 3.5.2 or newer.

Official ID

CVE-2012-2399

Report title

WordPress Core <= 3.5.1 - Cross-Site Scripting

First reported

21 April 2012

Sources

Wordfence, seen 21 April 2012

This week

Someone could use it to harm your site (before 3.3.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.3.2

Fixed in

3.3.2

What to do

If your site has an affected version, update WordPress to version 3.3.2 or newer.

Official ID

CVE-2012-2401

Report title

WordPress Core <= 3.3.1 - Same Origin Policy Bypass

First reported

20 April 2012

Sources

Wordfence, seen 20 April 2012

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.3.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.3.1

Fixed in

3.3.2

What to do

If your site has an affected version, update WordPress to version 3.3.2 or newer.

Official ID

CVE-2012-2403

Report title

WordPress Core < 3.3.2 - Cross-Site Scripting

First reported

20 April 2012

Sources

Wordfence, seen 20 April 2012

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.3.1) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.3.1

Fixed in

3.3.2

What to do

If your site has an affected version, update WordPress to version 3.3.2 or newer.

Official ID

CVE-2012-3414

Report title

WordPress Core <= 3.3.1 - Cross-Site Scripting

First reported

20 April 2012

Sources

Wordfence, seen 20 April 2012

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.3.1) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.3.1

Fixed in

3.3.2

What to do

If your site has an affected version, update WordPress to version 3.3.2 or newer.

Official ID

CVE-2012-2400

Report title

WordPress Core < 3.3.2 - Cross-Site Scripting

First reported

20 April 2012

Sources

Wordfence, seen 20 April 2012

This week

Someone could use it to harm your site (up to and including 3.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.3.1

Fixed in

3.3.2

What to do

If your site has an affected version, update WordPress to version 3.3.2 or newer.

Official ID

CVE-2012-2402

Report title

WordPress Core < 3.3.2 - Authorization Bypass

First reported

20 April 2012

Sources

Wordfence, seen 20 April 2012

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.3

Fixed in

3.3.1

What to do

If your site has an affected version, update WordPress to version 3.3.1 or newer.

Official ID

CVE-2012-0287

Report title

WordPress Core <= 3.3 - Cross-Site Scripting

First reported

3 January 2012

Sources

Wordfence, seen 3 January 2012

This week

Someone could use it to harm your site (up to and including 3.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.1.2

Fixed in

3.2

What to do

If your site has an affected version, update WordPress to version 3.2 or newer.

Official ID

CVE-2011-3122

Report title

WordPress Core < 3.1.3 - Media Related Security Issue

First reported

25 May 2011

Sources

Wordfence, seen 25 May 2011

This week

Someone could use it to harm your site (up to and including 3.1.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.1.2

Fixed in

3.1.3

What to do

If your site has an affected version, update WordPress to version 3.1.3 or newer.

Official ID

CVE-2011-3125

Report title

WordPress Core < 3.1.3 - Security Hardening

First reported

25 May 2011

Sources

Wordfence, seen 25 May 2011

This week

Someone could use it to harm your site (up to and including 3.1.2) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.1.2

Fixed in

3.1.3

What to do

If your site has an affected version, update WordPress to version 3.1.3 or newer.

Official ID

CVE-2011-3126

Report title

WordPress Core < 3.1.3 - Username Enumeration

First reported

25 May 2011

Sources

Wordfence, seen 25 May 2011

This week

Someone could run their own code on your site and take it over (up to and including 3.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.1.2

Fixed in

3.1.3

What to do

If your site has an affected version, update WordPress to version 3.1.3 or newer.

Official ID

CVE-2011-3129

Report title

WordPress Core <= 3.1.2 - Arbitrary File Upload

First reported

25 May 2011

Sources

Wordfence, seen 25 May 2011

This week

Someone could read or change the data in your site’s database (up to and including 3.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.1.2

Fixed in

3.1.3

What to do

If your site has an affected version, update WordPress to version 3.1.3 or newer.

Official ID

CVE-2011-3130

Report title

WordPress Core <= 3.1.2 - SQL Injection

First reported

25 May 2011

Sources

Wordfence, seen 25 May 2011

This week

Someone could use it to harm your site (up to and including 3.1.2) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.1.2

Fixed in

3.1.3

What to do

If your site has an affected version, update WordPress to version 3.1.3 or newer.

Official ID

CVE-2011-3128

Report title

WordPress Core < 3.1.3 - Sensitive Information Disclosure

First reported

25 May 2011

Sources

Wordfence, seen 25 May 2011

This week

Someone could use it to harm your site (up to and including 3.1.2) (5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.1.2

Fixed in

3.1.3

What to do

If your site has an affected version, update WordPress to version 3.1.3 or newer.

Official ID

CVE-2011-3127

Report title

WordPress Core < 3.1.3 - Clickjacking

First reported

25 May 2011

Sources

Wordfence, seen 25 May 2011

This week

Someone could use it to harm your site (before 3.0.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.0.6

Fixed in

3.0.6

What to do

If your site has an affected version, update WordPress to version 3.0.6 or newer.

Official ID

CVE-2011-5270

Report title

WordPress Core < 3.0.6 - Incorrect Authorization Checks

First reported

26 April 2011

Sources

Wordfence, seen 26 April 2011

This week

Someone could use it to harm your site (up to and including 3.1.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.1.1

Fixed in

3.1.2

What to do

If your site has an affected version, update WordPress to version 3.1.2 or newer.

Official ID

CVE-2011-1762

Report title

WordPress Core < 3.1.2 - Incorrect Authorization for Contributor-level users

First reported

26 April 2011

Sources

Wordfence, seen 26 April 2011

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.1

Fixed in

3.1.1

What to do

If your site has an affected version, update WordPress to version 3.1.1 or newer.

Official ID

CVE-2011-4956

Report title

WordPress Core <= 3.1 - Cross-Site Scripting

First reported

5 April 2011

Sources

Wordfence, seen 5 April 2011

This week

Someone could slow down or crash your site (before 3.1.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.1.1

Fixed in

3.1.1

What to do

If your site has an affected version, update WordPress to version 3.1.1 or newer.

Official ID

CVE-2011-4957

Report title

WordPress Core < 3.1.1 - Denial of Service

First reported

5 April 2011

Sources

Wordfence, seen 5 April 2011

This week

Someone could use it to harm your site (up to and including 3.0.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.0.4

Fixed in

3.0.5

What to do

If your site has an affected version, update WordPress to version 3.0.5 or newer.

Official ID

CVE-2011-0701

Report title

WordPress Core < 3.0.5 - Improper Authorization to Information Disclosure

First reported

7 February 2011

Sources

Wordfence, seen 7 February 2011

This week

Someone could use it to harm your site (from 2.9.2 up to and including 2.9.2; from 3.0.4 up to and including 3.0.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 2.9.2 up to and including 2.9.2
From 3.0.4 up to and including 3.0.4

Fixed in

3.0, 3.0.5

What to do

If your site has an affected version, update WordPress to version 3.0.5 or newer.

Official ID

CVE-2011-3818

Report title

WordPress Core 2.9.2 and 3.0.4 - Sensitive Information Disclosure

First reported

28 January 2011

Sources

Wordfence, seen 28 January 2011

This week

Someone could do things on your site they should not be allowed to (before 3.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.0.2

Fixed in

3.0.2

What to do

If your site has an affected version, update WordPress to version 3.0.2 or newer.

Official ID

CVE-2010-5296

Report title

WordPress Core < 3.0.2 - Missing Authorization

First reported

30 December 2010

Sources

Wordfence, seen 30 December 2010

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.0.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.0.3

Fixed in

3.0.4

What to do

If your site has an affected version, update WordPress to version 3.0.4 or newer.

Official ID

CVE-2010-4536

Report title

WordPress Core <= 3.0.3 - Cross-Site Scripting

First reported

29 December 2010

Sources

Wordfence, seen 29 December 2010

This week

Someone could use it to harm your site (up to and including 3.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.0.2

Fixed in

3.0.3

What to do

If your site has an affected version, update WordPress to version 3.0.3 or newer.

Official ID

CVE-2010-5106

Report title

WordPress Core < 3.0.3 - Access Control Bypass

First reported

8 December 2010

Sources

Wordfence, seen 8 December 2010

This week

Someone could use it to harm your site (before 3.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.0.2

Fixed in

3.0.2

What to do

If your site has an affected version, update WordPress to version 3.0.2 or newer.

Official ID

CVE-2010-5293

Report title

WordPress Core < 3.0.2 - Spam Protection Bypass

First reported

30 November 2010

Sources

Wordfence, seen 30 November 2010

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.0.2

Fixed in

3.0.2

What to do

If your site has an affected version, update WordPress to version 3.0.2 or newer.

Official ID

CVE-2010-5294

Report title

WordPress Core < 3.0.2 - Cross-Site Scripting

First reported

30 November 2010

Sources

Wordfence, seen 30 November 2010

This week

Someone could read or change the data in your site’s database (up to and including 3.0.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.0.1

Fixed in

3.0.2

What to do

If your site has an affected version, update WordPress to version 3.0.2 or newer.

Official ID

CVE-2010-4257

Report title

WordPress Core <= 3.0.1 - SQL Injection

First reported

30 November 2010

Sources

Wordfence, seen 30 November 2010

This week

Someone could plant harmful code that runs for your visitors or admins (before 3.0.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.0.2

Fixed in

3.0.2

What to do

If your site has an affected version, update WordPress to version 3.0.2 or newer.

Official ID

CVE-2010-5295

Report title

WordPress Core < 3.0.2 - Cross-Site Scripting

First reported

30 November 2010

Sources

Wordfence, seen 30 November 2010

This week

Someone could do things on your site they should not be allowed to (before 3.0.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 3.0.1

Fixed in

3.0.1

What to do

If your site has an affected version, update WordPress to version 3.0.1 or newer.

Official ID

CVE-2010-5297

Report title

WordPress Core < 3.0.1 - Missing Authorization

First reported

29 July 2010

Sources

Wordfence, seen 29 July 2010

This week

Someone could use it to harm your site (before 2.9.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 2.9.2

Fixed in

2.9.2

What to do

If your site has an affected version, update WordPress to version 2.9.2 or newer.

Official ID

CVE-2010-0682

Report title

WordPress Core < 2.9.2 - Authorization Bypass

First reported

15 February 2010

Sources

Wordfence, seen 15 February 2010

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.8.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8.5

Fixed in

2.8.6

What to do

If your site has an affected version, update WordPress to version 2.8.6 or newer.

Official ID

CVE-2009-3891

Report title

WordPress Core <= 2.8.5 - Cross-Site Scripting

First reported

12 December 2009

Sources

Wordfence, seen 12 December 2009

This week

Someone could run their own code on your site and take it over (up to and including 2.8.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8.5

Fixed in

2.8.6

What to do

If your site has an affected version, update WordPress to version 2.8.6 or newer.

Official ID

CVE-2009-3890

Report title

WordPress Core <= 2.8.5 - Arbitrary File Upload

First reported

12 December 2009

Sources

Wordfence, seen 12 December 2009

This week

Someone could slow down or crash your site (up to and including 2.8.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8.4

Fixed in

2.8.5

What to do

If your site has an affected version, update WordPress to version 2.8.5 or newer.

Official ID

CVE-2009-3622

Report title

WordPress Core <= 2.8.4 - Denial of Service

First reported

20 October 2009

Sources

Wordfence, seen 20 October 2009

This week

Someone could use it to harm your site (up to and including 2.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8

Fixed in

2.8.1

What to do

If your site has an affected version, update WordPress to version 2.8.1 or newer.

Official ID

CVE-2009-2432

Report title

WordPress Core & WordPress MU < 2.8.1 - Full Path Disclosure

First reported

8 September 2009

Sources

Wordfence, seen 8 September 2009

This week

Someone could use it to harm your site (up to and including 2.8) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8

Fixed in

2.8.1

What to do

If your site has an affected version, update WordPress to version 2.8.1 or newer.

Official ID

CVE-2009-2432

Report title

WordPress Core & WordPress MU < 2.8.1 - Full Path Disclosure

First reported

8 September 2009

Sources

Wordfence, seen 8 September 2009

This week

Someone could use it to harm your site (up to and including 2.8.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8.3

Fixed in

2.8.4

What to do

If your site has an affected version, update WordPress to version 2.8.4 or newer.

Official ID

CVE-2009-2762

Report title

WordPress Core < 2.8.4 - Forced Password Reset

First reported

12 August 2009

Sources

Wordfence, seen 12 August 2009

This week

Someone could do things on your site they should not be allowed to (up to and including 2.8.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8.2

Fixed in

2.8.3

What to do

If your site has an affected version, update WordPress to version 2.8.3 or newer.

Official ID

CVE-2009-2854

Report title

WordPress Core < 2.8.3 - Missing Authorization

First reported

3 August 2009

Sources

Wordfence, seen 3 August 2009

This week

Someone could use it to harm your site (up to and including 2.8.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8.2

Fixed in

2.8.3

What to do

If your site has an affected version, update WordPress to version 2.8.3 or newer.

Official ID

CVE-2009-2853

Report title

WordPress Core < 2.8.3 - Authorization Bypass

First reported

3 August 2009

Sources

Wordfence, seen 3 August 2009

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8.1

Fixed in

2.8.2

What to do

If your site has an affected version, update WordPress to version 2.8.2 or newer.

Official ID

CVE-2009-2851

Report title

WordPress Core <= 2.8.1 - Cross-Site Scripting

First reported

20 July 2009

Sources

Wordfence, seen 20 July 2009

This week

Someone could use it to harm your site (up to and including 2.8) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8

Fixed in

2.8.1

What to do

If your site has an affected version, update WordPress to version 2.8.1 or newer.

Official ID

CVE-2009-2336

Report title

WordPress Core & WordPress MU < 2.8.1 - Username Enumeration

First reported

9 July 2009

Sources

Wordfence, seen 9 July 2009

This week

Someone could use it to harm your site (up to and including 2.8) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8

Fixed in

2.8.1

What to do

If your site has an affected version, update WordPress to version 2.8.1 or newer.

Official ID

CVE-2009-2336

Report title

WordPress Core & WordPress MU < 2.8.1 - Username Enumeration

First reported

9 July 2009

Sources

Wordfence, seen 9 July 2009

This week

Someone could use it to harm your site (up to and including 2.8) (5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8

Fixed in

2.8.1

What to do

If your site has an affected version, update WordPress to version 2.8.1 or newer.

Official ID

CVE-2009-2334

Report title

WordPress Core <= 2.8 - Sensitive Information Disclosure

First reported

9 July 2009

Sources

Wordfence, seen 9 July 2009

This week

Someone could use it to harm your site (up to and including 2.8) (6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8

Fixed in

2.8.1

What to do

If your site has an affected version, update WordPress to version 2.8.1 or newer.

Official ID

CVE-2009-2334

Report title

WordPress Core <= 2.8 - Sensitive Information Disclosure

First reported

9 July 2009

Sources

Wordfence, seen 9 July 2009

This week

Someone could use it to harm your site (up to and including 2.8) (7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8

Fixed in

2.8.1

What to do

If your site has an affected version, update WordPress to version 2.8.1 or newer.

Official ID

CVE-2009-2335

Report title

WordPress Core & WordPress MU < 2.8.1 - Username Enumeration

First reported

9 July 2009

Sources

Wordfence, seen 9 July 2009

This week

Someone could use it to harm your site (up to and including 2.8) (8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.8

Fixed in

2.8.1

What to do

If your site has an affected version, update WordPress to version 2.8.1 or newer.

Official ID

CVE-2009-2335

Report title

WordPress Core & WordPress MU < 2.8.1 - Username Enumeration

First reported

9 July 2009

Sources

Wordfence, seen 9 July 2009

This week

Someone could use it to harm your site (up to and including 2.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.7.1

Fixed in

2.8

What to do

If your site has an affected version, update WordPress to version 2.8 or newer.

Official ID

CVE-2009-2431

Report title

WordPress Core < 2.8 - Sensitive Information Disclosure

First reported

11 June 2009

Sources

Wordfence, seen 11 June 2009

This week

Someone could plant harmful code that runs for your visitors or admins (before 2.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 2.7

Fixed in

2.7

What to do

If your site has an affected version, update WordPress to version 2.7 or newer.

Official ID

CVE-2009-1030

Report title

WordPress MU < 2.7 - Cross-Site Scripting

First reported

10 March 2009

Sources

Wordfence, seen 10 March 2009

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.6.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.6.4

Fixed in

2.6.5

What to do

If your site has an affected version, update WordPress to version 2.6.5 or newer.

Official ID

CVE-2008-5278

Report title

WordPress Core < 2.6.5 - Cross-Site Scripting

First reported

25 December 2008

Sources

Wordfence, seen 25 December 2008

This week

Someone could slow down or crash your site (up to and including 2.6.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.6.1

Fixed in

2.7

What to do

If your site has an affected version, update WordPress to version 2.7 or newer.

Official ID

CVE-2008-6767

Report title

WordPress Core < 2.7 - Denial of Service

First reported

22 December 2008

Sources

Wordfence, seen 22 December 2008

This week

Someone could send your visitors from your site to a harmful site (before 2.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 2.8.1

Fixed in

2.8.1

What to do

If your site has an affected version, update WordPress to version 2.8.1 or newer.

Official ID

CVE-2008-6762

Report title

WordPress Core < 2.8.1 - Open Redirect

First reported

22 December 2008

Sources

Wordfence, seen 22 December 2008

This week

Someone could use it to harm your site (up to and including 2.6.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.6.1

Fixed in

2.6.2

What to do

If your site has an affected version, update WordPress to version 2.6.2 or newer.

Official ID

CVE-2008-4106

Report title

WordPress Core < 2.6.2 - Arbitrary User Password Reset

First reported

8 September 2008

Sources

Wordfence, seen 8 September 2008

This week

Someone could use it to harm your site (up to and including 2.6.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.6.1

Fixed in

2.6.2

What to do

If your site has an affected version, update WordPress to version 2.6.2 or newer.

Official ID

CVE-2008-4107

Report title

WordPress Core < 2.6.2 - Cryptographic Weakness

First reported

8 September 2008

Sources

Wordfence, seen 8 September 2008

This week

Someone could plant harmful code that runs for your visitors or admins (before 2.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 2.6

Fixed in

2.6

What to do

If your site has an affected version, update WordPress to version 2.6 or newer.

Official ID

CVE-2008-4671

Report title

WordPress MU < 2.6 - Cross-Site Scripting

First reported

1 September 2008

Sources

Wordfence, seen 1 September 2008

This week

Someone could use it to harm your site (up to and including 2.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.6

Fixed in

2.6.1

What to do

If your site has an affected version, update WordPress to version 2.6.1 or newer.

Official ID

CVE-2008-3747

Report title

WordPress Core < 2.6.1 - Cryptographic Weakness

First reported

15 August 2008

Sources

Wordfence, seen 15 August 2008

This week

Someone could plant harmful code that runs for your visitors or admins (before 2.6) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 2.6

Fixed in

2.6

What to do

If your site has an affected version, update WordPress to version 2.6 or newer.

Official ID

CVE-2008-3233

Report title

WordPress Core < 2.6 - Cross-Site Scripting

First reported

15 July 2008

Sources

Wordfence, seen 15 July 2008

This week

Someone could take over your site as an admin (up to and including 2.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.5

Fixed in

2.5.1

What to do

If your site has an affected version, update WordPress to version 2.5.1 or newer.

Official ID

CVE-2008-1930

Report title

WordPress Core < 2.5.1 - Authentication Bypass

First reported

25 April 2008

Sources

Wordfence, seen 25 April 2008

This week

Someone could use it to harm your site (up to and including 2.3.3; from 2.5 up to and including 2.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.3.3
From 2.5 up to and including 2.5

Fixed in

2.5.1

What to do

If your site has an affected version, update WordPress to version 2.5.1 or newer.

Official ID

CVE-2008-4769

Report title

WordPress Core <= 2.3.3 - Directory Traversal

First reported

25 April 2008

Sources

Wordfence, seen 25 April 2008

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.5

Fixed in

2.5.1

What to do

If your site has an affected version, update WordPress to version 2.5.1 or newer.

Official ID

CVE-2008-2068

Report title

WordPress Core <= 2.5 - Cross-Site Scripting

First reported

25 April 2008

Sources

Wordfence, seen 25 April 2008

This week

Someone could run their own code on your site and take it over (up to and including 2.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.5.1

Fixed in

2.5.2

What to do

If your site has an affected version, update WordPress to version 2.5.2 or newer.

Official ID

CVE-2008-2392

Report title

WordPress Core <= 2.5.1 - Arbitrary File Upload

First reported

25 April 2008

Sources

Wordfence, seen 25 April 2008

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.3.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.3.2

Fixed in

2.3.3

What to do

If your site has an affected version, update WordPress to version 2.3.3 or newer.

Official ID

CVE-2008-1304

Report title

WordPress Core <= 2.3.2 - Cross-Site Scripting

First reported

5 February 2008

Sources

Wordfence, seen 5 February 2008

This week

Someone could use it to harm your site (from 1.5 up to and including 2.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 1.5 up to and including 2.3.1

Fixed in

2.3.2

What to do

If your site has an affected version, update WordPress to version 2.3.2 or newer.

Official ID

CVE-2007-6013

Report title

WordPress Core 1.5 - 2.3.1 - Authorization Bypass

First reported

29 December 2007

Sources

Wordfence, seen 29 December 2007

This week

Someone could use it to harm your site (up to and including 2.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.4

Fixed in

2.5

What to do

If your site has an affected version, update WordPress to version 2.5 or newer.

Official ID

CVE-2008-0191

Report title

WordPress Core < 2.5 - Full Path Disclosure

First reported

16 December 2007

Sources

Wordfence, seen 16 December 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.3

Fixed in

2.3.1

What to do

If your site has an affected version, update WordPress to version 2.3.1 or newer.

Official ID

CVE-2007-5710

Report title

WordPress Core <= 2.3 - Cross-Site Scripting

First reported

26 October 2007

Sources

Wordfence, seen 26 October 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.3

Fixed in

2.0.4

What to do

If your site has an affected version, update WordPress to version 2.0.4 or newer.

Official ID

CVE-2007-5106

Report title

WordPress Core < 2.0.4 - Cross-Site Scripting

First reported

21 September 2007

Sources

Wordfence, seen 21 September 2007

This week

Someone could read or change the data in your site’s database (up to and including 2.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.3.1

Fixed in

2.3.2

What to do

If your site has an affected version, update WordPress to version 2.3.2 or newer.

Official ID

CVE-2007-6318

Report title

WordPress Core < 2.3.2 - SQL Injection

First reported

8 September 2007

Sources

Wordfence, seen 8 September 2007

This week

Someone could run their own code on your site and take it over (up to and including 1.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 1.3.1

Fixed in

1.3.2

What to do

If your site has an affected version, update WordPress to version 1.3.2 or newer.

Official ID

CVE-2008-5695

Report title

WordPress Core < 2.3.3 & WordPress MU < 1.3.2 - Remote Code Execution

First reported

8 September 2007

Sources

Wordfence, seen 8 September 2007

This week

Someone could run their own code on your site and take it over (up to and including 2.3.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.3.2

Fixed in

2.3.3

What to do

If your site has an affected version, update WordPress to version 2.3.3 or newer.

Official ID

CVE-2008-5695

Report title

WordPress Core < 2.3.3 & WordPress MU < 1.3.2 - Remote Code Execution

First reported

8 September 2007

Sources

Wordfence, seen 8 September 2007

This week

Someone could use it to harm your site (up to and including 2.3.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.3.2

Fixed in

2.3.3

What to do

If your site has an affected version, update WordPress to version 2.3.3 or newer.

Official ID

CVE-2008-0664

Report title

WordPress Core < 2.3.3 - Improper Authorization Checks

First reported

8 September 2007

Sources

Wordfence, seen 8 September 2007

This week

Someone could read or change the data in your site’s database (before 1.2.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 1.2.5

Fixed in

1.2.5

What to do

If your site has an affected version, update WordPress to version 1.2.5 or newer.

Official ID

CVE-2007-4894

Report title

WordPress Core < 2.2.3 & WordPress MU < 1.2.5a - SQL Injection

First reported

8 September 2007

Sources

Wordfence, seen 8 September 2007

This week

Someone could read or change the data in your site’s database (before 2.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 2.2.3

Fixed in

2.2.3

What to do

If your site has an affected version, update WordPress to version 2.2.3 or newer.

Official ID

CVE-2007-4894

Report title

WordPress Core < 2.2.3 & WordPress MU < 1.2.5a - SQL Injection

First reported

8 September 2007

Sources

Wordfence, seen 8 September 2007

This week

Someone could use it to harm your site (up to and including 2.2.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.2.2

Fixed in

2.2.3

What to do

If your site has an affected version, update WordPress to version 2.2.3 or newer.

Official ID

CVE-2008-2146

Report title

WordPress Core < 2.2.3 - Restriction Bypass

First reported

8 September 2007

Sources

Wordfence, seen 8 September 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 1.0

Fixed in

1.1.1

What to do

If your site has an affected version, update WordPress to version 1.1.1 or newer.

Official ID

CVE-2007-4544

Report title

WordPress MU <= 1.0 - Cross-Site Scripting

First reported

22 August 2007

Sources

Wordfence, seen 22 August 2007

This week

Someone could send your visitors from your site to a harmful site (up to and including 2.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.2.1

Fixed in

2.2.2

What to do

If your site has an affected version, update WordPress to version 2.2.2 or newer.

Official ID

CVE-2007-3639

Report title

WordPress Core < 2.2.2 - Open Redirect

First reported

8 August 2007

Sources

Wordfence, seen 8 August 2007

This week

Someone could run their own code on your site and take it over (up to and including 1.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 1.2.3

Fixed in

1.2.4

What to do

If your site has an affected version, update WordPress to version 1.2.4 or newer.

Official ID

CVE-2007-3544

Report title

WordPress Core <= 2.2.1 - Arbitrary File Upload

First reported

5 August 2007

Sources

Wordfence, seen 5 August 2007

This week

Someone could run their own code on your site and take it over (up to and including 2.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.2.1

Fixed in

2.2.2

What to do

If your site has an affected version, update WordPress to version 2.2.2 or newer.

Official ID

CVE-2007-3544

Report title

WordPress Core <= 2.2.1 - Arbitrary File Upload

First reported

5 August 2007

Sources

Wordfence, seen 5 August 2007

This week

Someone could plant harmful code that runs for your visitors or admins (before 1.2.5a)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 1.2.5a

Fixed in

1.2.5a

What to do

If your site has an affected version, update WordPress to version 1.2.5a or newer.

Official ID

CVE-2007-4893

Report title

WordPress Core <= 2.2.2 - Cross-Site Scripting

First reported

5 August 2007

Sources

Wordfence, seen 5 August 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.2.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.2.2

Fixed in

2.2.3

What to do

If your site has an affected version, update WordPress to version 2.2.3 or newer.

Official ID

CVE-2007-4893

Report title

WordPress Core <= 2.2.2 - Cross-Site Scripting

First reported

5 August 2007

Sources

Wordfence, seen 5 August 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.10; from 2.2 up to and including 2.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.10
From 2.2 up to and including 2.2.1

Fixed in

2.0.11, 2.2.2

What to do

If your site has an affected version, update WordPress to version 2.2.2 or newer.

Official ID

CVE-2007-4139

Report title

WordPress Core <= 2.2.1 - Cross-Site Scripting

First reported

5 August 2007

Sources

Wordfence, seen 5 August 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.2.1

Fixed in

2.2.2

What to do

If your site has an affected version, update WordPress to version 2.2.2 or newer.

Official ID

CVE-2007-4153

Report title

WordPress Core <= 2.2.1 - Authenticated (Admin+) Cross-Site Scripting

First reported

5 August 2007

Sources

Wordfence, seen 5 August 2007

This week

Someone could run their own code on your site and take it over (up to and including 2.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.2

Fixed in

2.2.1

What to do

If your site has an affected version, update WordPress to version 2.2.1 or newer.

Official ID

CVE-2007-3543

Report title

WordPress Core <= 2.2 - Arbitrary File Upload

First reported

5 August 2007

Sources

Wordfence, seen 5 August 2007

This week

Someone could read or change the data in your site’s database (up to and including 2.0.10; from 2.2 up to and including 2.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.10
From 2.2 up to and including 2.2.1

Fixed in

2.0.11, 2.2.2

What to do

If your site has an affected version, update WordPress to version 2.2.2 or newer.

Official ID

CVE-2007-4154

Report title

WordPress Core <= 2.2.1 - SQL Injection

First reported

5 August 2007

Sources

Wordfence, seen 5 August 2007

This week

Someone could read or change the data in your site’s database (up to and including 2.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.2

Fixed in

2.2.1

What to do

If your site has an affected version, update WordPress to version 2.2.1 or newer.

Official ID

CVE-2007-3140

Report title

WordPress Core <= 2.2 - SQL Injection

First reported

21 June 2007

Sources

Wordfence, seen 21 June 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.2

Fixed in

2.2.1

What to do

If your site has an affected version, update WordPress to version 2.2.1 or newer.

Official ID

CVE-2007-2627

Report title

WordPress Core <= 2.2 - Cross-Site Scripting

First reported

21 June 2007

Sources

Wordfence, seen 21 June 2007

This week

Someone could use it to harm your site (up to and including 2.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.1.2

Fixed in

2.1.3

What to do

If your site has an affected version, update WordPress to version 2.1.3 or newer.

Official ID

CVE-2007-1893

Report title

WordPress Core < 2.1.3 - Authorization Bypass

First reported

3 April 2007

Sources

Wordfence, seen 3 April 2007

This week

Someone could read or change the data in your site’s database (before 2.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 2.1.3

Fixed in

2.1.3

What to do

If your site has an affected version, update WordPress to version 2.1.3 or newer.

Official ID

CVE-2007-1897

Report title

WordPress Core < 2.1.3 - SQL Injection

First reported

3 April 2007

Sources

Wordfence, seen 3 April 2007

This week

Someone could send your visitors from your site to a harmful site (before 2.0.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 2.0.10

Fixed in

2.0.10

What to do

If your site has an affected version, update WordPress to version 2.0.10 or newer.

Official ID

CVE-2007-1599

Report title

WordPress Core < 2.0.10 - Open Redirect

First reported

3 April 2007

Sources

Wordfence, seen 3 April 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.9; from 2.1 up to and including 2.1.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.9
From 2.1 up to and including 2.1.1

Fixed in

2.0.10, 2.1.2

What to do

If your site has an affected version, update WordPress to version 2.1.2 or newer.

Official ID

CVE-2007-1622

Report title

WordPress Core <= 2.1.2 - Cross-Site Scripting

First reported

3 April 2007

Sources

Wordfence, seen 3 April 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.9; from 2.1 up to and including 2.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.9
From 2.1 up to and including 2.1.2

Fixed in

2.0.10, 2.1.3

What to do

If your site has an affected version, update WordPress to version 2.1.3 or newer.

Official ID

CVE-2007-1894

Report title

WordPress Core <= 2.1.2 - Cross-Site Scripting

First reported

3 April 2007

Sources

Wordfence, seen 3 April 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.9

Fixed in

2.0.10

What to do

If your site has an affected version, update WordPress to version 2.0.10 or newer.

Official ID

CVE-2008-0192

Report title

WordPress Core <= 2.0.9 - Cross-Site Scripting

First reported

3 April 2007

Sources

Wordfence, seen 3 April 2007

This week

Someone could use it to harm your site (from 2.2.1 up to and including 2.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 2.2.1 up to and including 2.2.1

Fixed in

2.2.2

What to do

If your site has an affected version, update WordPress to version 2.2.2 or newer.

Official ID

CVE-2007-1277

Report title

WordPress Core 2.2.1 - Backdoor

First reported

3 March 2007

Sources

Wordfence, seen 3 March 2007

This week

Someone could use it to harm your site (from 2.1.1 up to and including 2.1.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 2.1.1 up to and including 2.1.1

Fixed in

2.1.2

What to do

If your site has an affected version, update WordPress to version 2.1.2 or newer.

Report title

WordPress Core 2.1.1 - Supply Chain Compromise

First reported

2 March 2007

Sources

Wordfence, seen 2 March 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.1.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.1.1

Fixed in

2.1.2

What to do

If your site has an affected version, update WordPress to version 2.1.2 or newer.

Official ID

CVE-2007-1230

Report title

WordPress Core <= 2.1.1 - Cross-Site Scripting

First reported

2 March 2007

Sources

Wordfence, seen 2 March 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.1.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.1.1

Fixed in

2.1.2

What to do

If your site has an affected version, update WordPress to version 2.1.2 or newer.

Official ID

CVE-2007-1244

Report title

WordPress Core <= 2.1.1 - Cross-Site Scripting

First reported

2 March 2007

Sources

Wordfence, seen 2 March 2007

This week

Someone could plant harmful code that runs for your visitors or admins (before 2.0.9; from 2.1 up to and including 2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 2.0.9
From 2.1 up to and including 2.1

Fixed in

2.0.9, 2.1.1

What to do

If your site has an affected version, update WordPress to version 2.1.1 or newer.

Official ID

CVE-2007-1049

Report title

WordPress Core < 2.09 - Cross-Site Scripting

First reported

21 February 2007

Sources

Wordfence, seen 21 February 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.0.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 3.0.4

Fixed in

3.0.5

What to do

If your site has an affected version, update WordPress to version 3.0.5 or newer.

Official ID

CVE-2011-0700

Report title

WordPress Core <= 3.0.4 - Cross-Site Scripting

First reported

11 February 2007

Sources

Wordfence, seen 11 February 2007

This week

Someone could use it to harm your site (before 2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 2.1

Fixed in

2.1

What to do

If your site has an affected version, update WordPress to version 2.1 or newer.

Official ID

CVE-2007-0541

Report title

WordPress Core < 2.1 - Directory Traversal

First reported

24 January 2007

Sources

Wordfence, seen 24 January 2007

This week

Someone could use it to harm your site (up to and including 2.0.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.11

Fixed in

2.1

What to do

If your site has an affected version, update WordPress to version 2.1 or newer.

Official ID

CVE-2008-0195

Report title

WordPress Core < 2.1 - Full Path Disclosure

First reported

22 January 2007

Sources

Wordfence, seen 22 January 2007

This week

Someone could slow down or crash your site (before 2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 2.1

Fixed in

2.1

What to do

If your site has an affected version, update WordPress to version 2.1 or newer.

Official ID

CVE-2007-0539

Report title

WordPress Core < 2.1 - Denial of Service

First reported

22 January 2007

Sources

Wordfence, seen 22 January 2007

This week

Someone could use it to harm your site (up to and including 2.0.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.6

Fixed in

2.0.7

What to do

If your site has an affected version, update WordPress to version 2.0.7 or newer.

Official ID

CVE-2007-0262

Report title

WordPress Core < 2.0.7 - Full Path Disclosure

First reported

15 January 2007

Sources

Wordfence, seen 15 January 2007

This week

Someone could read or change the data in your site’s database (up to and including 2.0.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.6

Fixed in

2.0.7

What to do

If your site has an affected version, update WordPress to version 2.0.7 or newer.

Official ID

CVE-2007-0233

Report title

WordPress Core < 2.0.7 - SQL Injection

First reported

15 January 2007

Sources

Wordfence, seen 15 January 2007

This week

Someone could use it to harm your site (up to and including 2.0.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.5

Fixed in

2.0.6

What to do

If your site has an affected version, update WordPress to version 2.0.6 or newer.

Official ID

CVE-2007-0109

Report title

WordPress < 2.0.6 - Username Enumeration via Error Messages

First reported

5 January 2007

Sources

Wordfence, seen 5 January 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.5

Fixed in

2.0.6

What to do

If your site has an affected version, update WordPress to version 2.0.6 or newer.

Official ID

CVE-2007-0106

Report title

WordPress Core <= 2.0.5 - Cross-Site Request Forgery to Cross-Site Scripting

First reported

5 January 2007

Sources

Wordfence, seen 5 January 2007

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.5) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.5

Fixed in

2.0.6

What to do

If your site has an affected version, update WordPress to version 2.0.6 or newer.

Official ID

CVE-2006-6808

Report title

WordPress Core <= 2.0.5 - Cross-Site Scripting

First reported

5 January 2007

Sources

Wordfence, seen 5 January 2007

This week

Someone could read or change the data in your site’s database (up to and including 2.0.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.5

Fixed in

2.0.6

What to do

If your site has an affected version, update WordPress to version 2.0.6 or newer.

Official ID

CVE-2007-0107

Report title

WordPress Core <= 2.0.5 - SQL Injection

First reported

5 January 2007

Sources

Wordfence, seen 5 January 2007

This week

Someone could use it to harm your site (from 2.0.2 up to and including 2.0.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

From 2.0.2 up to and including 2.0.5

Fixed in

2.0.6

What to do

If your site has an affected version, update WordPress to version 2.0.6 or newer.

Official ID

CVE-2006-4743

Report title

WordPress Core 2.0.2 - 2.0.5 - Sensitive Information Disclosure

First reported

5 January 2007

Sources

Wordfence, seen 5 January 2007

This week

Someone could use it to harm your site (up to and including 2.0.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.4

Fixed in

2.0.5

What to do

If your site has an affected version, update WordPress to version 2.0.5 or newer.

Official ID

CVE-2006-5705

Report title

WordPress Core <= 2.0.4 - Directory Traversal

First reported

27 October 2006

Sources

Wordfence, seen 27 October 2006

This week

Someone could slow down or crash your site (up to and including 2.0.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.4

Fixed in

2.0.5

What to do

If your site has an affected version, update WordPress to version 2.0.5 or newer.

Official ID

CVE-2006-6017

Report title

WordPress Core <= 2.0.4 - Denial of Service

First reported

27 October 2006

Sources

Wordfence, seen 27 October 2006

This week

Someone could use it to harm your site (up to and including 2.0.4) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.4

Fixed in

2.0.5

What to do

If your site has an affected version, update WordPress to version 2.0.5 or newer.

Official ID

CVE-2006-6016

Report title

WordPress Core < 2.0.5 - User Metadata Information Disclosure

First reported

18 September 2006

Sources

Wordfence, seen 18 September 2006

This week

Someone could use it to harm your site (before 1.5.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 1.5.2

Fixed in

1.5.2

What to do

If your site has an affected version, update WordPress to version 1.5.2 or newer.

Official ID

CVE-2005-4463

Report title

WordPress Core < 1.5.2 - Full Path Disclosure

First reported

14 August 2006

Sources

Wordfence, seen 14 August 2006

This week

Someone could use it to harm your site (up to and including 2.0.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.3

Fixed in

2.0.4

What to do

If your site has an affected version, update WordPress to version 2.0.4 or newer.

Official ID

CVE-2006-3390

Report title

WordPress Core < 2.0.4 - Full Path Disclosure

First reported

29 July 2006

Sources

Wordfence, seen 29 July 2006

This week

Someone could slow down or crash your site (up to and including 2.0.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.3

Fixed in

2.0.4

What to do

If your site has an affected version, update WordPress to version 2.0.4 or newer.

Official ID

CVE-2008-0194

Report title

WordPress Core <= 2.0.3 - Denial of Service

First reported

29 July 2006

Sources

Wordfence, seen 29 July 2006

This week

Someone could take over your site as an admin (before 2.0.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 2.0.4

Fixed in

2.0.4

What to do

If your site has an affected version, update WordPress to version 2.0.4 or newer.

Official ID

CVE-2006-4028

Report title

WordPress Core < 2.0.4 - Privilege Escalation

First reported

9 July 2006

Sources

Wordfence, seen 9 July 2006

This week

Someone could use it to harm your site (up to and including 2.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.2

Fixed in

2.0.3

What to do

If your site has an affected version, update WordPress to version 2.0.3 or newer.

Official ID

CVE-2006-2702

Report title

WordPress Core < 2.0.3 - IP Address Spoofing

First reported

1 June 2006

Sources

Wordfence, seen 1 June 2006

This week

Someone could run their own code on your site and take it over (up to and including 2.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.2

Fixed in

2.0.3

What to do

If your site has an affected version, update WordPress to version 2.0.3 or newer.

Official ID

CVE-2006-2667

Report title

WordPress Core < 2.0.3 - Remote Code Execution

First reported

1 June 2006

Sources

Wordfence, seen 1 June 2006

This week

Someone could use it to harm your site (up to and including 2.0.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.1

Fixed in

2.0.2

What to do

If your site has an affected version, update WordPress to version 2.0.2 or newer.

Official ID

CVE-2006-0986

Report title

WordPress Core < 2.0.2 - Sensitive Information Disclosure

First reported

10 March 2006

Sources

Wordfence, seen 10 March 2006

This week

Someone could plant harmful code that runs for your visitors or admins (before 2.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 2.0.2

Fixed in

2.0.2

What to do

If your site has an affected version, update WordPress to version 2.0.2 or newer.

Official ID

CVE-2007-5105

Report title

WordPress Core < 2.0.2 - Cross-Site Scripting

First reported

10 March 2006

Sources

Wordfence, seen 10 March 2006

This week

Someone could plant harmful code that runs for your visitors or admins (before 2.0.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 2.0.2

Fixed in

2.0.2

What to do

If your site has an affected version, update WordPress to version 2.0.2 or newer.

Official ID

CVE-2006-1263

Report title

WordPress Core < 2.0.2 - Reflected Cross-Site Scripting

First reported

10 March 2006

Sources

Wordfence, seen 10 March 2006

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0.1

Fixed in

2.0.2

What to do

If your site has an affected version, update WordPress to version 2.0.2 or newer.

Official ID

CVE-2006-0985

Report title

WordPress Core <= 2.0.1 - Cross-Site Scripting

First reported

10 March 2006

Sources

Wordfence, seen 10 March 2006

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 2.0

Fixed in

2.0.1

What to do

If your site has an affected version, update WordPress to version 2.0.1 or newer.

Official ID

CVE-2006-1796

Report title

WordPress Core < 2.0.1 - Cross-Site Scripting

First reported

31 January 2006

Sources

Wordfence, seen 31 January 2006

This week

Someone could read or change the data in your site’s database (up to and including 1.5.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 1.5.2

Fixed in

2.0

What to do

If your site has an affected version, update WordPress to version 2.0 or newer.

Official ID

CVE-2006-1012

Report title

WordPress Core <= 1.5.2 - SQL Injection

First reported

31 December 2005

Sources

Wordfence, seen 31 December 2005

This week

Someone could run their own code on your site and take it over (up to and including 1.5.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 1.5.1.3

Fixed in

1.5.2

What to do

If your site has an affected version, update WordPress to version 1.5.2 or newer.

Official ID

CVE-2005-2612

Report title

WordPress Core < 1.5.2 - Remote Code Execution

First reported

9 August 2005

Sources

Wordfence, seen 9 August 2005

This week

Someone could read or change the data in your site’s database (before 1.5.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 1.5.1.3

Fixed in

1.5.1.3

What to do

If your site has an affected version, update WordPress to version 1.5.1.3 or newer.

Official ID

CVE-2005-2108

Report title

WordPress Core < 1.5.1.3 - SQL Injection

First reported

29 June 2005

Sources

Wordfence, seen 29 June 2005

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 1.5.1.2

Fixed in

1.5.1.3

What to do

If your site has an affected version, update WordPress to version 1.5.1.3 or newer.

Official ID

CVE-2005-2107

Report title

WordPress Core <= 1.5.1.2 - Cross-Site Scripting

First reported

29 June 2005

Sources

Wordfence, seen 29 June 2005

This week

Someone could use it to harm your site (up to and including 1.5.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 1.5.1.2

Fixed in

1.5.1.3

What to do

If your site has an affected version, update WordPress to version 1.5.1.3 or newer.

Official ID

CVE-2005-2110

Report title

WordPress Core < 1.5.1.3 - Sensitive Information Disclosure

First reported

29 June 2005

Sources

Wordfence, seen 29 June 2005

This week

Someone could use it to harm your site (up to and including 1.5.1.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 1.5.1.2

Fixed in

1.5.1.3

What to do

If your site has an affected version, update WordPress to version 1.5.1.3 or newer.

Official ID

CVE-2005-2109

Report title

WordPress Core < 1.5.1.3 - Arbitrary Email Content Change

First reported

29 June 2005

Sources

Wordfence, seen 29 June 2005

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 1.5.1

Fixed in

1.5.1.2

What to do

If your site has an affected version, update WordPress to version 1.5.1.2 or newer.

Official ID

CVE-2005-1102

Report title

WordPress Core <= 1.5 - Stored Cross-Site Scripting

First reported

27 June 2005

Sources

Wordfence, seen 27 June 2005

This week

Someone could read or change the data in your site’s database (up to and including 1.5.1.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 1.5.1.1

Fixed in

1.5.1.2

What to do

If your site has an affected version, update WordPress to version 1.5.1.2 or newer.

Official ID

CVE-2005-1810

Report title

WordPress Core < 1.5.1.2 - SQL Injection

First reported

27 May 2005

Sources

Wordfence, seen 27 May 2005

This week

Someone could use it to harm your site (before 1.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 1.5.1

Fixed in

1.5.1

What to do

If your site has an affected version, update WordPress to version 1.5.1 or newer.

Official ID

CVE-2005-1688

Report title

WordPress Core < 1.5.1 - Full Path Disclosure

First reported

9 May 2005

Sources

Wordfence, seen 9 May 2005

This week

Someone could read or change the data in your site’s database (before 1.5.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 1.5.1

Fixed in

1.5.1

What to do

If your site has an affected version, update WordPress to version 1.5.1 or newer.

Official ID

CVE-2005-1687

Report title

WordPress Core < 1.5.1 - SQL Injection

First reported

9 May 2005

Sources

Wordfence, seen 9 May 2005

This week

Someone could plant harmful code that runs for your visitors or admins (before 1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 1.2

Fixed in

1.2

What to do

If your site has an affected version, update WordPress to version 1.2 or newer.

Official ID

CVE-2004-1559

Report title

WordPress Core < 1.2.1 - Cross-Site Scripting

First reported

6 October 2004

Sources

Wordfence, seen 6 October 2004

This week

Someone could use it to harm your site (before 1.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 1.2.1

Fixed in

1.2.1

What to do

If your site has an affected version, update WordPress to version 1.2.1 or newer.

Official ID

CVE-2004-1584

Report title

WordPress Core <= 1.2 - HTTP Response Splitting

First reported

6 October 2004

Sources

Wordfence, seen 6 October 2004

This week

Someone could read or change the data in your site’s database (before 0.72)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Before 0.72

Fixed in

0.72

What to do

If your site has an affected version, update WordPress to version 0.72 or newer.

Official ID

CVE-2003-1598

Report title

WordPress Core < 0.72 - SQL Injection

First reported

11 October 2003

Sources

Wordfence, seen 11 October 2003

This week

Someone could use it to harm your site (up to and including 0.70)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions

Up to and including 0.70

Fixed in

0.71

What to do

If your site has an affected version, update WordPress to version 0.71 or newer.

Official ID

CVE-2003-1599

Report title

WordPress Core <= 0.70 - Remote File Inclusion

First reported

9 June 2003

Sources

Wordfence, seen 9 June 2003

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)