wordpress wordpress

Name: wordpress wordpress
Brand: wordpress

productUS

cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

18critical80high236medium18low

updated 2026-10-26

vulnerabilities (356)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2016-10033US	critical9.8OT critical	99.7% (100th)	KEV	no fix	2016-12-30	≤ 4.7
CVE-2026-87902US	—OT critical	95.8% (100th)	KEV	5.0.29	2026-09-22	25 versions
CVE-2026-63030US	—OT critical	10.6% (96th)	KEV	6.9.5	2026-07-17	2 versions
CVE-2026-60137US	—OT critical	5.32% (93rd)	KEV	7.0.2	2026-07-17	3 versions
CVE-2022-21661US	high7.5	97.8% (100th)	Exploit	5.8.3	2022-01-06	22 versions
CVE-2016-10045US	critical9.8	97.7% (100th)	Exploit	no fix	2016-12-30	≤ 4.7
CVE-2019-8943US	medium6.5	92.0% (100th)	Exploit	no fix	2019-02-20	≤ 5.0.3
CVE-2017-5487US	medium5.3	87.3% (100th)	Exploit	no fix	2017-01-15	≤ 4.7
CVE-2021-29447US	medium6.5	85.7% (100th)	Exploit	5.7.1	2021-04-15	5.6.0 → 5.7.1
CVE-2009-2335US	medium5.0	85.0% (100th)	Exploit	2.8.1	2009-07-10	< 2.8.1
CVE-2017-1001000US	high7.5OT high	84.9% (100th)	Exploit	no fix	2017-04-03	3 versions
CVE-2019-8942US	high8.8	82.7% (100th)	Exploit	4.9.9	2019-02-20	2 versions
CVE-2014-9034US	medium5.0	82.7% (100th)	Exploit	no fix	2014-11-25	10 versions
CVE-2023-2745US	—	79.4% (100th)	Exploit	4.3.31	2023-05-17	22 versions
CVE-2018-6389US	high7.5	72.7% (99th)	Exploit	no fix	2018-02-06	≤ 4.9.2
CVE-2024-4439US	medium6.1	71.0% (99th)	Exploit	no fix	2024-05-03	6 versions
CVE-2018-12895US	high8.8	62.2% (99th)	Exploit	4.9.7	2018-06-26	< 4.9.7
CVE-2005-2612US	high7.5	38.8% (99th)	Exploit	no fix	2005-08-17	8 versions
CVE-2019-9787US	high8.8	38.6% (99th)	Exploit	5.1.1	2019-03-14	< 5.1.1
CVE-2016-6896US	high7.1	38.1% (99th)	Exploit	no fix	2017-01-18	= 4.5.3
CVE-2019-17671US	medium5.3	36.5% (98th)	Exploit	5.2.4	2019-10-17	< 5.2.4
CVE-2013-0235US	medium6.4	29.6% (98th)	Exploit	no fix	2013-07-08	74 versions
CVE-2016-6897US	medium6.5	28.8% (98th)	Exploit	no fix	2017-01-18	≤ 4.5.5
CVE-2007-1277US	high7.5	27.8% (98th)	Exploit	no fix	2007-03-05	= 2.1.1
CVE-2018-20148US	critical9.8	26.8% (98th)	Exploit	4.9.9	2018-12-14	2 versions
CVE-2017-8295US	medium5.9	26.7% (98th)	Exploit	no fix	2017-05-04	≤ 4.7.4
CVE-2014-5266US	medium5.0	25.2% (98th)	Exploit	no fix	2014-08-18	31 versions
CVE-2013-7240US	medium5.0	19.6% (97th)	Exploit	no fix	2014-01-03	—
CVE-2009-2762US	high7.5	19.6% (97th)	Exploit	no fix	2009-08-13	≤ 2.8.3
CVE-2015-3440US	medium4.3	16.9% (97th)	Exploit	no fix	2015-08-03	≤ 4.2
CVE-2020-28032US	critical9.8	15.7% (97th)	Exploit	5.5.2	2020-11-02	< 5.5.2
CVE-2006-2667US	high7.5	14.5% (97th)	Exploit	no fix	2006-05-30	≤ 2.0.2
CVE-2020-11027US	high8.1	13.6% (96th)	Exploit	4.3.23	2020-04-30	18 versions
CVE-2017-14719US	high7.5	12.4% (96th)	Exploit	no fix	2017-09-23	202 versions
CVE-2008-5695US	high8.5	12.0% (96th)	Exploit	no fix	2008-12-19	≤ 2.3.2
CVE-2007-0107US	medium6.8	11.7% (96th)	Exploit	no fix	2007-01-09	≤ 2.0.5
CVE-2007-0233US	high7.5	11.7% (96th)	Exploit	no fix	2007-01-13	19 versions
CVE-2004-1584US	medium5.0	11.2% (96th)	Exploit	no fix	2004-12-31	= 1.2
CVE-2010-0682US	medium4.0	10.0% (96th)	Exploit	no fix	2010-02-23	2 versions
CVE-2005-2108US	high7.5	9.32% (95th)	Exploit	no fix	2005-07-05	7 versions
CVE-2011-4898US	medium5.0	9.21% (95th)	Exploit	no fix	2012-01-30	73 versions
CVE-2014-0166US	medium6.4	9.17% (95th)	Exploit	no fix	2014-04-10	95 versions
CVE-2007-6318US	medium6.8	9.16% (95th)	Exploit	no fix	2007-12-12	24 versions
CVE-2012-3414US	medium4.3	9.09% (95th)	Exploit	no fix	2013-07-19	17 versions
CVE-2011-4899US	high7.5	9.02% (95th)	Exploit	no fix	2012-01-30	73 versions
CVE-2008-4769US	high9.3	8.97% (95th)	Exploit	no fix	2008-10-28	60 versions
CVE-2009-3890US	medium6.0	8.43% (95th)	Exploit	no fix	2009-11-17	≤ 2.8.5
CVE-2009-2851US	medium4.3	7.90% (95th)	Exploit	no fix	2009-08-18	≤ 2.8.1
CVE-2012-0937US	medium5.0	7.63% (95th)	Exploit	no fix	2012-01-30	73 versions
CVE-2007-0540US	medium5.0OT elevated	7.59% (95th)	Exploit	no fix	2007-01-29	≤ 2.0

showing 50 of 356

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')122 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor33 CVEs
CWE-264CWE-26430 CVEs
CWE-20Improper Input Validation28 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')23 CVEs
CWE-352Cross-Site Request Forgery (CSRF)22 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')12 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')9 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE356 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan