Branches de versions concernées
- 7.1 1 CVE KEV 1
- 7.0 4 CVE KEV 3
- 6.9 4 CVE KEV 3
- 6.8 6 CVE KEV 2
- 6.7 5 CVE KEV 1
- 6.6 5 CVE KEV 1
- 6.5 5 CVE KEV 1
- 6.4 5 CVE KEV 1
- 6.3 6 CVE KEV 1
- 6.2 6 CVE KEV 1
- 6.1 7 CVE KEV 1
- 6.0 7 CVE KEV 1
- 5.9 7 CVE KEV 1
- 5.8 7 CVE KEV 1
- 5.7 7 CVE KEV 1
- 5.6 7 CVE KEV 1
- 5.5 7 CVE KEV 1
- 5.4 7 CVE KEV 1
- 5.3 9 CVE KEV 1
- 5.2 9 CVE KEV 1
- 5.1 8 CVE KEV 1
- 5.0 9 CVE KEV 1
- 4.9 9 CVE KEV 1
- 4.8 9 CVE KEV 1
- 4.7 7 CVE KEV 1
- 4.1 6 CVE KEV 1
- 3.5 5 CVE KEV 1
Vulnérabilités connues
| CVE | Titre | Versions concernées | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|---|
| CVE-2026-87902 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable... | < 7.1.2 | 8.1 | KEV | 95.8% | 2026-09-23 |
| CVE-2026-63030 | WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution | ≥ 6.9.0 < 6.9.5 ≥ 7.0.0 < 7.0.2 | 9.8 | KEV | 10.6% | 2026-07-18 |
| CVE-2026-60137 | WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query | ≥ 6.8.0 < 6.8.6 ≥ 6.9.0 < 6.9.5 ≥ 7.0.0 < 7.0.2 | 5.9 | KEV | 5.3% | 2026-07-18 |
| CVE-2026-65640 | WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Au... | < 7.0.4 | 8.8 | — | 2026-08-18 | |
| CVE-2026-64638 | WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially craf... | * | 8.9 | — | 2026-08-08 | |
| CVE-2025-58674 | WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability | ≥ 6.8 ≤ 6.8.2 ≥ 6.7 ≤ 6.7.3 ≥ 6.6 ≤ 6.6.3 | 5.9 | — | 2025-09-24 | |
| CVE-2025-58246 | WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability | ≥ 6.8 ≤ 6.8.2 ≥ 6.7 ≤ 6.7.3 ≥ 6.6 ≤ 6.6.3 | 4.3 | — | 2025-09-24 | |
| CVE-2025-54352 | WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.pi... | ≥ 3.5 ≤ 6.8.2 | 3.7 | — | 2025-07-21 | |
| CVE-2024-3558 | Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title] | * | 6.4 | — | 2024-06-20 | |
| CVE-2023-5561 | WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure | ≥ 6.3.0 < 6.3.2 ≥ 6.2.0 < 6.2.3 ≥ 6.1.0 < 6.1.4 | 5.3 | — | 2023-10-17 | |
| CVE-2023-22622 | WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resultin... | * | 5.3 | — | 2023-01-05 | |
| CVE-2022-3590 | WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding | ≥ 4.1.30 ≤ 6.1.1 | 5.9 | — | 2022-12-14 | |
| CVE-2020-11026 | Specially crafted filenames in WordPress leading to XSS | * | 8.7 | — | 2020-05-01 | |
| CVE-2020-11028 | Unauthenticated disclosure of certain private posts in WordPress | * | 5.8 | — | 2020-05-01 | |
| CVE-2020-11029 | Cross-site scripting in stats method (object cache) in WordPress | * | 5.8 | — | 2020-05-01 | |
| CVE-2020-11030 | Cross-site scripting (XSS) in Search block in WordPress | * | 6.4 | — | 2020-05-01 | |
| CVE-2020-11025 | Authenticated cross-site scripting (XSS) in WordPress Customizer | * | 5.8 | — | 2020-05-01 | |
| CVE-2020-11027 | Password reset links invalidation issue in WordPress | * | 6.1 | — | 2020-04-30 | |
| CVE-2019-16781 | Stored cross-site scripting (XSS) in WordPress block editor | ≥ < 5.3.1 < 5.3.1 | 5.8 | — | 2019-12-27 | |
| CVE-2019-16780 | Stored cross-site scripting (XSS) in WordPress block editor | ≥ < 5.3.1 < 5.3.1 | 5.8 | — | 2019-12-27 | |
| CVE-2019-17671 | In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query pro... | * | — | — | 2019-10-17 | |
| CVE-2019-17673 | WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests l... | * | — | — | 2019-10-17 | |
| CVE-2019-17675 | WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin... | * | — | — | 2019-10-17 | |
| CVE-2019-17669 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not... | * | — | — | 2019-10-17 | |
| CVE-2019-17670 | WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishan... | * | — | — | 2019-10-17 | |
| CVE-2019-16222 | WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php... | * | — | — | 2019-09-11 | |
| CVE-2019-16220 | In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggab... | * | — | — | 2019-09-11 | |
| CVE-2019-9787 | WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthent... | * | — | — | 2019-03-15 | |
| CVE-2018-20149 | In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload craf... | * | — | — | 2018-12-15 | |
| CVE-2018-20150 | In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving... | * | — | — | 2018-12-15 | |
| CVE-2018-10100 | Before WordPress 4.9.5, the redirection URL for the login page was not validated or sanitized if forced to use... | * | — | — | 2018-04-14 | |
| CVE-2018-10101 | Before WordPress 4.9.5, the URL validator assumed URLs with the hostname localhost were on the same host as th... | * | — | — | 2018-04-14 | |
| CVE-2018-10102 | Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead t... | * | — | — | 2018-04-14 | |
| CVE-2018-5776 | WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement)... | * | — | — | 2018-01-19 | |
| CVE-2017-17093 | wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an... | * | — | — | 2017-12-02 | |
| CVE-2017-17094 | wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields, w... | * | — | — | 2017-12-02 | |
| CVE-2017-17092 | wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload... | * | — | — | 2017-12-02 | |
| CVE-2017-17091 | wp-admin/user-new.php in WordPress before 4.9.1 sets the newbloguser key to a string that can be directly deri... | * | — | — | 2017-12-02 | |
| CVE-2017-16510 | WordPress before 4.8.3 is affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries... | * | — | — | 2017-11-03 | |
| CVE-2017-14723 | Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, a... | * | — | — | 2017-09-24 | |
| CVE-2017-9061 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very la... | * | — | — | 2017-05-18 | |
| CVE-2017-9065 | In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API. | * | — | — | 2017-05-18 | |
| CVE-2017-9064 | In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credenti... | * | — | — | 2017-05-18 | |
| CVE-2017-9062 | In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. | * | — | — | 2017-05-18 | |
| CVE-2017-9066 | In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF. | * | — | — | 2017-05-18 | |
| CVE-2017-9063 | In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involv... | * | — | — | 2017-05-18 | |
| CVE-2017-1001000 | The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST... | * | — | — | 2017-04-03 | |
| CVE-2017-6818 | In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term nam... | * | — | — | 2017-03-12 | |
| CVE-2017-6816 | In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the... | * | — | — | 2017-03-12 | |
| CVE-2017-6815 | In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation. | * | — | — | 2017-03-12 | |
| CVE-2017-6814 | In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is... | * | — | — | 2017-03-12 | |
| CVE-2017-6819 | In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-w... | * | — | — | 2017-03-12 | |
| CVE-2017-6817 | In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTub... | * | — | — | 2017-03-12 | |
| CVE-2017-5611 | SQL injection vulnerability in wp-includes/class-wp-query.php in WP_Query in WordPress before 4.7.2 allows rem... | * | — | — | 2017-01-30 | |
| CVE-2017-5610 | wp-admin/includes/class-wp-press-this.php in Press This in WordPress before 4.7.2 does not properly restrict v... | * | — | — | 2017-01-30 | |
| CVE-2017-5612 | Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list... | * | — | — | 2017-01-30 | |
| CVE-2016-6897 | Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/aja... | * | — | — | 2017-01-19 | |
| CVE-2017-5487 | wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress... | * | — | — | 2017-01-15 | |
| CVE-2017-5490 | Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-them... | * | — | — | 2017-01-15 | |
| CVE-2017-5488 | Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/update-core.php in WordPress before 4.7.1 allo... | * | — | — | 2017-01-15 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).