[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWwqZ5igE2u0JtPC374Yi-TZ4RyZ73KSHmZJrWrEtYMo":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":213,"kevVulnerabilities":273,"topProductsByCves":279,"seoMetadata":290,"meta":299},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":212},35214,"wordpress",50,621,1,1187,"2024-10-16","w",[16,20,27,33,37,42,46,50,54,59,63,67,70,75,79,83,87,90,94,98,102,106,110,113,117,120,123,127,131,135,139,142,146,149,154,158,162,165,169,173,176,180,184,187,191,195,199,202,206,209],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},172012,722,578,{"id":21,"product_name":22,"version_count":23,"cve_count":24,"kev_count":25,"last_cve_update":26},172014,"wordpress_mu",34,10,0,"2009-07-10",{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":25,"last_cve_update":32},172005,"sniplets_plugin",2,3,"2008-02-28",{"id":34,"product_name":35,"version_count":25,"cve_count":30,"kev_count":25,"last_cve_update":36},171991,"math_comment_spam_protection_plugin","2008-01-10",{"id":38,"product_name":39,"version_count":40,"cve_count":30,"kev_count":25,"last_cve_update":41},172011,"wassup_plugin",7,"2012-06-15",{"id":43,"product_name":44,"version_count":30,"cve_count":30,"kev_count":25,"last_cve_update":45},171977,"blix","2007-08-22",{"id":47,"product_name":48,"version_count":25,"cve_count":30,"kev_count":25,"last_cve_update":49},171993,"pay-with-tweet","2012-10-09",{"id":51,"product_name":52,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":53},171983,"dean_logan_wp-people_plugin","2008-02-20",{"id":55,"product_name":56,"version_count":57,"cve_count":11,"kev_count":25,"last_cve_update":58},171984,"debug_bar",21,"2023-03-11",{"id":60,"product_name":61,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":62},171985,"download_monitor_plugin","2008-04-30",{"id":64,"product_name":65,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":66},171986,"fcchat_widget","2012-06-17",{"id":68,"product_name":69,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":36},171987,"filemanager",{"id":71,"product_name":72,"version_count":73,"cve_count":11,"kev_count":25,"last_cve_update":74},171988,"gutenberg",316,"2023-10-13",{"id":76,"product_name":77,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":78},171989,"health_check_\\&_troubleshooting","2023-05-25",{"id":80,"product_name":81,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":82},171990,"lanoba_social_plugin","2012-09-20",{"id":84,"product_name":85,"version_count":40,"cve_count":11,"kev_count":25,"last_cve_update":86},171992,"page_flip_image_gallery_plugin","2008-12-30",{"id":88,"product_name":89,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":78},171994,"performance_lab",{"id":91,"product_name":92,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":93},171995,"permalinks_migration_plugin","2008-01-31",{"id":95,"product_name":96,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":97},171996,"peter\\'s_math_anti-spam_for_wordpress","2009-09-11",{"id":99,"product_name":100,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":101},171997,"photo_album_plugin","2008-02-25",{"id":103,"product_name":104,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":105},171998,"pictpress","2007-12-15",{"id":107,"product_name":108,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":109},171999,"plugin_newsletter_plugin","2012-06-19",{"id":111,"product_name":112,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":45},172000,"pool",{"id":114,"product_name":115,"version_count":31,"cve_count":11,"kev_count":25,"last_cve_update":116},172001,"requests","2021-04-27",{"id":118,"product_name":119,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":53},172002,"search_unleashed_plugin",{"id":121,"product_name":122,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":45},172003,"sirius",{"id":124,"product_name":125,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":126},172004,"slideshow_gallery2","2012-10-01",{"id":128,"product_name":129,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":130},172006,"spambam_plugin","2008-10-20",{"id":132,"product_name":133,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":134},172007,"st_newsletter_plugin","2008-02-12",{"id":136,"product_name":137,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":138},172008,"unamed_theme","2007-08-07",{"id":140,"product_name":141,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":138},172009,"unamed_theme_se",{"id":143,"product_name":144,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":145},172010,"upload_file_plugin","2008-05-29",{"id":147,"product_name":148,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":45},172013,"wordpressclassic",{"id":150,"product_name":151,"version_count":152,"cve_count":11,"kev_count":25,"last_cve_update":153},172015,"wordpress-users",5,"2011-12-02",{"id":155,"product_name":156,"version_count":157,"cve_count":11,"kev_count":25,"last_cve_update":134},172016,"wordspew",38,{"id":159,"product_name":160,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":161},172017,"wp_cal_plugin","2008-01-30",{"id":163,"product_name":164,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":36},172018,"wp-contactform",{"id":166,"product_name":167,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":168},172019,"wp_download","2008-04-02",{"id":170,"product_name":171,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":172},172020,"wp_downloads_manager","2008-07-30",{"id":174,"product_name":175,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":134},172021,"wp-footnotes",{"id":177,"product_name":178,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":179},172022,"wp_forum","2008-01-23",{"id":181,"product_name":182,"version_count":40,"cve_count":11,"kev_count":25,"last_cve_update":183},172023,"wp_maintenance_mode_plugin","2013-06-21",{"id":185,"product_name":186,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":93},171975,"adserve",{"id":188,"product_name":189,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":190},172024,"wpss","2008-04-27",{"id":192,"product_name":193,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":194},171976,"alert_before_you_post","2012-08-23",{"id":196,"product_name":197,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":198},171978,"blixed","2007-07-26",{"id":200,"product_name":201,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":198},171979,"blixkrieg",{"id":203,"product_name":204,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":205},171980,"blogger_importer","2023-06-04",{"id":207,"product_name":208,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":36},171981,"captcha",{"id":210,"product_name":211,"version_count":25,"cve_count":11,"kev_count":25,"last_cve_update":36},171982,"cryptographp","Wordpress is a technology vendor with 50 tracked products and 621 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[214,222,227,234,241,248,253,258,263,268],{"cveId":215,"description":216,"publishedDate":217,"cvssScore":218,"cvssVersion":219,"severity":220,"isKev":4,"epssScore":221},"CVE-2016-10033","The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted Sender property.","2016-12-30",9.8,"v3.1","Critical",0.99714,{"cveId":223,"description":224,"publishedDate":217,"cvssScore":218,"cvssVersion":219,"severity":220,"isKev":225,"epssScore":226},"CVE-2016-10045","The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.",false,0.98038,{"cveId":228,"description":229,"publishedDate":230,"cvssScore":231,"cvssVersion":219,"severity":232,"isKev":225,"epssScore":233},"CVE-2022-21661","WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.","2022-01-06",7.5,"High",0.97795,{"cveId":235,"description":236,"publishedDate":237,"cvssScore":238,"cvssVersion":219,"severity":239,"isKev":225,"epssScore":240},"CVE-2019-8943","WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ..\u002F sequences, such as a filename ending with the .jpg?\u002F..\u002F..\u002Ffile.jpg substring.","2019-02-20",6.5,"Medium",0.91985,{"cveId":242,"description":243,"publishedDate":244,"cvssScore":245,"cvssVersion":246,"severity":239,"isKev":225,"epssScore":247},"CVE-2017-5487","wp-includes\u002Frest-api\u002Fendpoints\u002Fclass-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json\u002Fwp\u002Fv2\u002Fusers request.","2017-01-15",5.3,"v3.0",0.87299,{"cveId":249,"description":250,"publishedDate":251,"cvssScore":238,"cvssVersion":219,"severity":239,"isKev":225,"epssScore":252},"CVE-2021-29447","Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.","2021-04-15",0.85719,{"cveId":254,"description":255,"publishedDate":26,"cvssScore":152,"cvssVersion":256,"severity":239,"isKev":225,"epssScore":257},"CVE-2009-2335","WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.  NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for \"user convenience.\"","v2",0.85,{"cveId":259,"description":260,"publishedDate":261,"cvssScore":152,"cvssVersion":256,"severity":239,"isKev":225,"epssScore":262},"CVE-2014-9034","wp-includes\u002Fclass-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016.","2014-11-25",0.83162,{"cveId":264,"description":265,"publishedDate":237,"cvssScore":266,"cvssVersion":246,"severity":232,"isKev":225,"epssScore":267},"CVE-2019-8942","WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.",8.8,0.82736,{"cveId":269,"description":270,"publishedDate":271,"cvssScore":231,"cvssVersion":246,"severity":232,"isKev":225,"epssScore":272},"CVE-2017-1001000","The register_routes function in wp-includes\u002Frest-api\u002Fendpoints\u002Fclass-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows remote attackers to modify arbitrary pages via a request for wp-json\u002Fwp\u002Fv2\u002Fposts followed by a numeric value and a non-numeric value, as demonstrated by the wp-json\u002Fwp\u002Fv2\u002Fposts\u002F123?id=123helloworld URI.","2017-04-03",0.81848,[274],{"cveId":215,"description":216,"publishedDate":217,"cvssScore":218,"cvssVersion":219,"severity":220,"isKev":4,"epssScore":221,"cisaVulnName":275,"cisaDateAdded":276,"cisaShortDescription":277,"cisaRequiredAction":278},"PHPMailer Command Injection Vulnerability","2025-07-07","PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",[280,281,282,283,284,285,286,287,288,289],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},{"id":21,"product_name":22,"version_count":23,"cve_count":24,"kev_count":25,"last_cve_update":26},{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":25,"last_cve_update":32},{"id":34,"product_name":35,"version_count":25,"cve_count":30,"kev_count":25,"last_cve_update":36},{"id":38,"product_name":39,"version_count":40,"cve_count":30,"kev_count":25,"last_cve_update":41},{"id":43,"product_name":44,"version_count":30,"cve_count":30,"kev_count":25,"last_cve_update":45},{"id":47,"product_name":48,"version_count":25,"cve_count":30,"kev_count":25,"last_cve_update":49},{"id":51,"product_name":52,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":53},{"id":55,"product_name":56,"version_count":57,"cve_count":11,"kev_count":25,"last_cve_update":58},{"id":60,"product_name":61,"version_count":11,"cve_count":11,"kev_count":25,"last_cve_update":62},{"title":291,"metaDescription":292,"keywords":293,"structuredData":294},"Wordpress - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Wordpress covering 50 products with 621 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Wordpress vulnerabilities, Wordpress security, Wordpress CVE, Wordpress threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Wordpress KEV, Wordpress exploited vulnerabilities",{"@context":295,"@type":296,"name":297,"description":292,"url":298},"https:\u002F\u002Fschema.org","Organization","Wordpress","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fwordpress",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":300,"apiVersion":301},"2026-10-28T17:50:37.093Z","3.0"]