Skip to content
OpenAdvisories

Product · WordPress

wordpress-develop

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.5
    CVE-2024-31211 Public exploit

    Remote Code Execution in `WP_HTML_Token`

    WordPress is an open publishing platform for the Web. Unserialization of instances of the `WP_HTML_Token` class allows for code execution via its `__destruct()` magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4…

    WordPress wordpress-develop wordpress wordpress Web / CMS Debian Ubuntu
  • High 8.0
    CVE-2022-21661 Public exploit EPSS 98%

    SQL injection in WordPress

    WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain wa…

    WordPress wordpress-develop wordpress wordpress Web / CMS Debian Ubuntu
  • High 7.1
    CVE-2021-29447 Public exploit EPSS 86%

    WordPress Authenticated XXE attack when installation is running PHP 8

    Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possibl…

    WordPress wordpress-develop wordpress wordpress Web / CMS Debian Ubuntu