WordPress.org vulnerabilities

7 published CVEs name WordPress.org among the affected products.

Newest CVEs

CVE-2026-100508
WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability
WordPress.org · Two Factor
Medium5.3
CVE-2025-64253
WordPress Health Check & Troubleshooting plugin <= 1.7.1 - Path Traversal vulnerability
WordPress.org · Health Check & Troubleshooting
Medium4.9
CVE-2023-39999
WordPress < 6.3.2 is vulnerable to Broken Access Control
WordPress.org · WordPress
Medium4.3
CVE-2023-38000
Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block
WordPress.org · WordPress
Medium6.5
CVE-2022-43504
Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who…
WordPress.org · WordPress
Medium5.3
CVE-2022-43500
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer…
WordPress.org · WordPress
Medium6.1
CVE-2022-43497
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer…
WordPress.org · WordPress
Medium6.1