WordPress Core Vulnerabilities

Title	CVE ID	CVSS	Vector	Date
WordPress Core < 5.4.2 - Self-Cross Site Scripting via Theme Folder Name	CVE-2020-4049	2.4	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N	June 10, 2020
WordPress Core < 3.9.2 - Denial of Service via XML	CVE-2014-5265	2.7	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L	August 6, 2014
WordPress Core < 5.4.2 - Arbitrary User Meta Update	CVE-2020-4050	3.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N	June 10, 2020
WordPress Core < 4.8.2 - Open Redirect in Admin Dashboard	CVE-2017-14725	3.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L	September 19, 2017
WordPress Core < 6.0.3 - Shared User Instance Weakness		3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N	October 18, 2022
WordPress Core < 6.0.3 - Information Disclosure (Multi-Part Email Leak)		3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	October 18, 2022
WordPress Core - Informational < 6.8 - Weak Hashing Algorithm	CVE-2012-6707	3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	June 20, 2012
WordPress Core < 3.9.2 - Authenticated Cross-Site Scripting via Avatar URL	CVE-2014-5240	3.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N	August 6, 2014
WordPress Core < 3.4.2 - Missing Authorization Checks	CVE-2012-4422	3.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L	September 6, 2012
WordPress Core - All known versions - Unauthenticated Blind Server Side Request Forgery	CVE-2022-3590	4.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N	September 6, 2022
WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite		4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	August 8, 2026
WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass		4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	August 8, 2026
WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API	CVE-2026-3906	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	March 10, 2026
WordPress <= 6.9.1 - Missing Authorization to Authenticated (Author+) Sensitive Information Disclosure via query-attachments AJAX Endpoint		4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	March 10, 2026
WordPress <= 6.8.2 - Authenticated (Contributor+) Sensitive Information Exposure	CVE-2025-58246	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	September 22, 2025
WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal	CVE-2024-32111	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	June 24, 2024
WordPress Core <= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts	CVE-2023-39999	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	October 12, 2023
WordPress Core < 6.2.1 - Cross-Site Request Forgery		4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	May 16, 2023
WordPress Core < 6.0.3 - Authenticated Information Disclosure via REST-API		4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	October 18, 2022
WordPress Core < 5.5.2 - Cross-Site Request Forgery to Theme Image Change	CVE-2020-28040	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	October 29, 2020

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation