debian/wordpress vulnerabilities

Latest debian/wordpress CVEs

Newest publication first · page 1 of 18

1. CVE-2026-119977 WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

   Published 2026-10-31

   High·CVSS 8.1 EPSS 1.2% CISA KEV added 2026-11-03 Exploited in the wild

   WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgr...

2. CVE-2026-66666 WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability

   Published 2026-10-06

   Medium·CVSS 6.9

   Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9,...

3. CVE-2026-87902 wordpress: WordPress: Remote code execution via page template resolution vulnerability

   Published 2026-09-22

   High·CVSS 8.1 EPSS 95.8% CISA KEV added 2026-09-25 Exploited in the wild

   An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

4. CVE-2026-93485 WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability

   Published 2026-09-18

   High·CVSS 7.1

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.

5. CVE-2026-65640 WordPress Core <= 7.0.3 - Authenticated (Author+) Remote Code Execution via Malicious File Upload

   Published 2026-08-17

   High·CVSS 8.8

   WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the upload_files capability This issue affects all versions o...

6. CVE-2026-64638 WordPress Core <= 7.0.2 - Unauthenticated Reflected Cross-Site Scripting via log Parameter

   Published 2026-08-07

   High·CVSS 8.9

   WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. Th...

7. CVE-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

   Published 2026-07-17

   Critical·CVSS 9.8 EPSS 10.6% CISA KEV added 2026-07-21 Exploited in the wild Framework module

   WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

8. CVE-2026-60137 WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

   Published 2026-07-17

   Medium·CVSS 5.9 EPSS 5.3% CISA KEV added 2026-07-21 Exploited in the wild Framework module

   WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

9. CVE-2026-3906 WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API

   Published 2026-03-11

   Medium·CVSS 4.3

   WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API create_item_permis...

10. DSA-6091-1 wordpress - security update

    Published 2025-12-21

    Unknown

11. DSA-6075-1 wordpress - security update

    Published 2025-12-10

    Unknown

12. DLA-4358-1 wordpress - security update

    Published 2025-11-02

    Unknown

13. CVE-2025-58674 WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability

    Published 2025-09-23

    Medium·CVSS 5.9

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows Stored XSS. WordPress core security team is aware of the issue and working on a fix. This is low severity vulnerability that requires an attacker to have Author...

14. CVE-2025-58246 WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability

    Published 2025-09-23

    Medium·CVSS 4.3

    Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerability. Contributor-level privileges require...

15. CVE-2025-54352 WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.

    Published 2025-07-21

    Low·CVSS 3.7

    WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.

16. CVE-2022-4973 WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function

    Published 2024-10-16

    Medium·CVSS 5.4

    WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary...

17. CVE-2024-31111 WordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerability

    Published 2024-06-25

    Medium·CVSS 6.5

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6...

18. CVE-2024-6307 WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API

    Published 2024-06-25

    Medium·CVSS 6.4

    WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access and above, to inje...

19. DSA-5685-1 wordpress - security update

    Published 2024-05-08

    Unknown

20. CVE-2024-4439 WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This mak...

    Published 2024-05-03

    Medium·CVSS 6.1

    WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and ab...

21. CVE-2023-5692 WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink

    Published 2024-04-05

    Medium·CVSS 5.3

    WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set t...

22. CVE-2024-31211 Remote Code Execution in `WP_HTML_Token`

    Published 2024-04-04

    Critical·CVSS 9.8

    WordPress is an open publishing platform for the Web. Unserialization of instances of the WP_HTML_Token class allows for code execution via its __destruct() magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected.

23. CVE-2024-31210 PHP file upload bypass via Plugin installer

    Published 2024-04-04

    High·CVSS 8.8

    WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins -> Add New -> Upload Plugin screen in WordPress. If FTP credentials are requested for installati...

24. DLA-3756-1 wordpress - security update

    Published 2024-03-10

    Unknown

25. DLA-3658-1 wordpress - security update

    Published 2023-11-20

    Unknown

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.