wordpress security advisories
13 threat alerts tracking vulnerabilities and security advisories that affect wordpress products.
Vulnios monitors wordpress CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent wordpress security news in one place, or click into an individual alert for full detail.
Critical Vulnerability: CVE-2020-28036 — wordpress, fedoraproject — wordpress, fedora
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.
criticalCVE-2020-28036Critical Vulnerability: CVE-2020-28035 — wordpress, fedoraproject — wordpress, fedora
WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.
criticalCVE-2020-28035Critical Vulnerability: CVE-2020-28037 — wordpress, fedoraproject — wordpress, fedora
is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, lead
criticalCVE-2020-28037Critical Vulnerability: CVE-2020-28039 — wordpress, debian — wordpress, debian_linux
is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.
criticalCVE-2020-28039Critical Vulnerability: CVE-2020-28032 — wordpress, fedoraproject — wordpress, fedora
WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.
criticalCVE-2020-28032Critical Vulnerability: CVE-2019-20041 — wordpress, debian — wordpress, debian_linux
wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript&colon
criticalCVE-2019-20041Critical Vulnerability: CVE-2019-17670 — wordpress, debian — wordpress, debian_linux
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.
criticalCVE-2019-17670Critical Vulnerability: CVE-2019-17669 — wordpress, debian — wordpress, debian_linux
WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.
criticalCVE-2019-17669Critical Vulnerability: CVE-2018-20148 — wordpress, debian — wordpress, debian_linux
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serializ
criticalCVE-2018-20148Critical Vulnerability: CVE-2017-16510 — wordpress — wordpress
WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi) in plugins and themes, as demonstrated by a "do
criticalCVE-2017-16510Critical Vulnerability: CVE-2017-14723 — wordpress — wordpress
Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, and thus did not properly address the possibility of plugins and themes enabling SQL inject
criticalCVE-2017-14723Critical Vulnerability: CVE-2017-5611 — wordpress, debian — wordpress, debian_linux
SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected
criticalCVE-2017-5611Critical Vulnerability: CVE-2007-6013 — wordpress, fedoraproject — wordpress, fedora
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to bypass authentication by obtaining the MD5 hash from the user database, then gene
criticalCVE-2007-6013
Track wordpress exposure across your environment
Vulnios automatically cross-references your asset inventory against new wordpress CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan