[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWwqZ5igE2u0JtPC374Yi-TZ4RyZ73KSHmZJrWrEtYMo":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":213,"kevVulnerabilities":273,"topProductsByCves":295,"seoMetadata":306,"meta":315},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":212},35214,"wordpress",50,621,1,1187,"2024-10-16","w",[16,20,27,33,37,42,46,50,54,59,63,67,70,75,79,83,87,90,94,98,102,106,110,113,117,120,123,127,131,135,139,142,146,149,154,158,162,165,169,173,176,180,184,187,191,195,199,202,206,209],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},172012,722,578,{"id":21,"product_name":22,"version_count":23,"cve_count":24,"kev_count":25,"last_cve_update":26},172014,"wordpress_mu",34,10,0,"2009-07-10",{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":25,"last_cve_update":32},172005,"sniplets_plugin",2,3,"2008-02-28",{"id":34,"product_name":35,"version_count":25,"cve_count":30,"kev_count":25,"last_cve_update":36},171991,"math_comment_spam_protection_plugin","2008-01-10",{"id":38,"product_name":39,"version_count":40,"cve_count":30,"kev_count":25,"last_cve_update":41},172011,"wassup_plugin",7,"2012-06-15",{"id":43,"product_name":44,"version_count":30,"cve_count":30,"kev_count":25,"last_cve_update":45},171977,"blix","2007-08-22",{"id":47,"product_name":48,"version_count":25,"cve_count":30,"kev_count":25,"last_cve_update":49},171993,"pay-with-tweet","2012-10-09",{"id":51,"product_name":52,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":53},171983,"dean_logan_wp-people_plugin","2008-02-20",{"id":55,"product_name":56,"version_count":57,"cve_count":11,"kev_count":25,"last_cve_update":58},171984,"debug_bar",21,"2023-03-11",{"id":60,"product_name":61,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":62},171985,"download_monitor_plugin","2008-04-30",{"id":64,"product_name":65,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":66},171986,"fcchat_widget","2012-06-17",{"id":68,"product_name":69,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":36},171987,"filemanager",{"id":71,"product_name":72,"version_count":73,"cve_count":11,"kev_count":25,"last_cve_update":74},171988,"gutenberg",316,"2023-10-13",{"id":76,"product_name":77,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":78},171989,"health_check_\\&_troubleshooting","2023-05-25",{"id":80,"product_name":81,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":82},171990,"lanoba_social_plugin","2012-09-20",{"id":84,"product_name":85,"version_count":40,"cve_count":11,"kev_count":25,"last_cve_update":86},171992,"page_flip_image_gallery_plugin","2008-12-30",{"id":88,"product_name":89,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":78},171994,"performance_lab",{"id":91,"product_name":92,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":93},171995,"permalinks_migration_plugin","2008-01-31",{"id":95,"product_name":96,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":97},171996,"peter\\'s_math_anti-spam_for_wordpress","2009-09-11",{"id":99,"product_name":100,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":101},171997,"photo_album_plugin","2008-02-25",{"id":103,"product_name":104,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":105},171998,"pictpress","2007-12-15",{"id":107,"product_name":108,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":109},171999,"plugin_newsletter_plugin","2012-06-19",{"id":111,"product_name":112,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":45},172000,"pool",{"id":114,"product_name":115,"version_count":31,"cve_count":11,"kev_count":25,"last_cve_update":116},172001,"requests","2021-04-27",{"id":118,"product_name":119,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":53},172002,"search_unleashed_plugin",{"id":121,"product_name":122,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":45},172003,"sirius",{"id":124,"product_name":125,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":126},172004,"slideshow_gallery2","2012-10-01",{"id":128,"product_name":129,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":130},172006,"spambam_plugin","2008-10-20",{"id":132,"product_name":133,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":134},172007,"st_newsletter_plugin","2008-02-12",{"id":136,"product_name":137,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":138},172008,"unamed_theme","2007-08-07",{"id":140,"product_name":141,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":138},172009,"unamed_theme_se",{"id":143,"product_name":144,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":145},172010,"upload_file_plugin","2008-05-29",{"id":147,"product_name":148,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":45},172013,"wordpressclassic",{"id":150,"product_name":151,"version_count":152,"cve_count":11,"kev_count":25,"last_cve_update":153},172015,"wordpress-users",5,"2011-12-02",{"id":155,"product_name":156,"version_count":157,"cve_count":11,"kev_count":25,"last_cve_update":134},172016,"wordspew",38,{"id":159,"product_name":160,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":161},172017,"wp_cal_plugin","2008-01-30",{"id":163,"product_name":164,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":36},172018,"wp-contactform",{"id":166,"product_name":167,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":168},172019,"wp_download","2008-04-02",{"id":170,"product_name":171,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":172},172020,"wp_downloads_manager","2008-07-30",{"id":174,"product_name":175,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":134},172021,"wp-footnotes",{"id":177,"product_name":178,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":179},172022,"wp_forum","2008-01-23",{"id":181,"product_name":182,"version_count":40,"cve_count":11,"kev_count":25,"last_cve_update":183},172023,"wp_maintenance_mode_plugin","2013-06-21",{"id":185,"product_name":186,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":93},171975,"adserve",{"id":188,"product_name":189,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":190},172024,"wpss","2008-04-27",{"id":192,"product_name":193,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":194},171976,"alert_before_you_post","2012-08-23",{"id":196,"product_name":197,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":198},171978,"blixed","2007-07-26",{"id":200,"product_name":201,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":198},171979,"blixkrieg",{"id":203,"product_name":204,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":205},171980,"blogger_importer","2023-06-04",{"id":207,"product_name":208,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":36},171981,"captcha",{"id":210,"product_name":211,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":36},171982,"cryptographp","Wordpress is a technology vendor with 50 tracked products and 621 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[214,222,230,234,241,248,253,258,263,268],{"cveId":215,"description":216,"publishedDate":217,"cvssScore":218,"cvssVersion":219,"severity":220,"isKev":4,"epssScore":221},"CVE-2016-10033","The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted Sender property.","2016-12-30",9.8,"v3.1","Critical",0.99714,{"cveId":223,"description":224,"publishedDate":225,"cvssScore":226,"cvssVersion":219,"severity":227,"isKev":228,"epssScore":229},"CVE-2022-21661","WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.","2022-01-06",7.5,"High",false,0.97795,{"cveId":231,"description":232,"publishedDate":217,"cvssScore":218,"cvssVersion":219,"severity":220,"isKev":228,"epssScore":233},"CVE-2016-10045","The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.",0.97738,{"cveId":235,"description":236,"publishedDate":237,"cvssScore":238,"cvssVersion":219,"severity":239,"isKev":228,"epssScore":240},"CVE-2019-8943","WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ..\u002F sequences, such as a filename ending with the .jpg?\u002F..\u002F..\u002Ffile.jpg substring.","2019-02-20",6.5,"Medium",0.91985,{"cveId":242,"description":243,"publishedDate":244,"cvssScore":245,"cvssVersion":246,"severity":239,"isKev":228,"epssScore":247},"CVE-2017-5487","wp-includes\u002Frest-api\u002Fendpoints\u002Fclass-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json\u002Fwp\u002Fv2\u002Fusers request.","2017-01-15",5.3,"v3.0",0.87299,{"cveId":249,"description":250,"publishedDate":251,"cvssScore":238,"cvssVersion":219,"severity":239,"isKev":228,"epssScore":252},"CVE-2021-29447","Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.","2021-04-15",0.85719,{"cveId":254,"description":255,"publishedDate":26,"cvssScore":152,"cvssVersion":256,"severity":239,"isKev":228,"epssScore":257},"CVE-2009-2335","WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.  NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for \"user convenience.\"","v2",0.85,{"cveId":259,"description":260,"publishedDate":261,"cvssScore":226,"cvssVersion":246,"severity":227,"isKev":228,"epssScore":262},"CVE-2017-1001000","The register_routes function in wp-includes\u002Frest-api\u002Fendpoints\u002Fclass-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json\u002Fwp\u002Fv2\u002Fposts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json\u002Fwp\u002Fv2\u002Fposts\u002F123?id=123helloworld URI.","2017-04-03",0.84935,{"cveId":264,"description":265,"publishedDate":237,"cvssScore":266,"cvssVersion":246,"severity":227,"isKev":228,"epssScore":267},"CVE-2019-8942","WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.",8.8,0.82736,{"cveId":269,"description":270,"publishedDate":271,"cvssScore":152,"cvssVersion":256,"severity":239,"isKev":228,"epssScore":272},"CVE-2014-9034","wp-includes\u002Fclass-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.","2014-11-25",0.82702,[274,283,290],{"cveId":275,"description":276,"publishedDate":277,"cvssScore":218,"cvssVersion":219,"severity":220,"isKev":4,"epssScore":278,"cisaVulnName":279,"cisaDateAdded":280,"cisaShortDescription":281,"cisaRequiredAction":282},"CVE-2026-63030","WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","2026-07-17",0.10649,"WordPress Core Interpretation Conflict Vulnerability","2026-07-21","WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",{"cveId":284,"description":285,"publishedDate":277,"cvssScore":286,"cvssVersion":219,"severity":239,"isKev":4,"epssScore":287,"cisaVulnName":288,"cisaDateAdded":280,"cisaShortDescription":289,"cisaRequiredAction":282},"CVE-2026-60137","WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.",5.9,0.05323,"WordPress Core SQL Injection Vulnerability","WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.",{"cveId":215,"description":216,"publishedDate":217,"cvssScore":218,"cvssVersion":219,"severity":220,"isKev":4,"epssScore":221,"cisaVulnName":291,"cisaDateAdded":292,"cisaShortDescription":293,"cisaRequiredAction":294},"PHPMailer Command Injection Vulnerability","2025-07-07","PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",[296,297,298,299,300,301,302,303,304,305],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},{"id":21,"product_name":22,"version_count":23,"cve_count":24,"kev_count":25,"last_cve_update":26},{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":25,"last_cve_update":32},{"id":34,"product_name":35,"version_count":25,"cve_count":30,"kev_count":25,"last_cve_update":36},{"id":38,"product_name":39,"version_count":40,"cve_count":30,"kev_count":25,"last_cve_update":41},{"id":43,"product_name":44,"version_count":30,"cve_count":30,"kev_count":25,"last_cve_update":45},{"id":47,"product_name":48,"version_count":25,"cve_count":30,"kev_count":25,"last_cve_update":49},{"id":51,"product_name":52,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":53},{"id":55,"product_name":56,"version_count":57,"cve_count":11,"kev_count":25,"last_cve_update":58},{"id":60,"product_name":61,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":62},{"title":307,"metaDescription":308,"keywords":309,"structuredData":310},"Wordpress - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Wordpress covering 50 products with 621 tracked vulnerabilities including 2 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Wordpress vulnerabilities, Wordpress security, Wordpress CVE, Wordpress threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Wordpress KEV, Wordpress exploited vulnerabilities",{"@context":311,"@type":312,"name":313,"description":308,"url":314},"https:\u002F\u002Fschema.org","Organization","Wordpress","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fwordpress",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":316,"apiVersion":317},"2026-10-17T20:50:21.959Z","3.0"]