WordPress 4.0.33 Vulnerabilities

Version released on 2021-05-12

Download tar
Download zip
Published
Title
Fixed in
CVSS
Published
2022-10-17
Title
WP < 6.0.3 - Stored XSS via wp-mail.php
Fixed in
Fixed in 4.0.37
CVSS
4.8 (medium)
Published
2022-10-17
Title
WP < 6.0.3 - Open Redirect via wp_nonce_ays
Fixed in
Fixed in 4.0.37
CVSS
4.3 (medium)
Published
2022-10-17
Title
WP < 6.0.3 - Email Address Disclosure via wp-mail.php
Fixed in
Fixed in 4.0.37
CVSS
3.1 (low)
Published
2022-10-17
Title
WP < 6.0.3 - Reflected XSS via SQLi in Media Library
Fixed in
Fixed in 4.0.37
CVSS
4.7 (medium)
Published
2022-10-17
Title
WP < 6.0.3 - CSRF in wp-trackback.php
Fixed in
Fixed in 4.0.37
CVSS
3.1 (low)
Published
2022-10-17
Title
WP < 6.0.3 - Stored XSS via the Customizer
Fixed in
Fixed in 4.0.37
CVSS
3.4 (low)
Published
2022-10-17
Title
WP < 6.0.3 - Stored XSS via Comment Editing
Fixed in
Fixed in 4.0.37
CVSS
4.4 (medium)
Published
2022-10-17
Title
WP < 6.0.3 - Content from Multipart Emails Leaked
Fixed in
Fixed in 4.0.37
CVSS
3.7 (low)
Published
2022-10-17
Title
WP < 6.0.3 - SQLi in WP_Date_Query
Fixed in
Fixed in 4.0.37
CVSS
4.0 (medium)
Published
2022-10-17
Title
WP < 6.0.3 - Stored XSS via RSS Widget
Fixed in
Fixed in 4.0.37
CVSS
3.0 (low)
Published
2022-10-17
Title
WP < 6.0.3 - Data Exposure via REST Terms/Tags Endpoint
Fixed in
Fixed in 4.0.37
CVSS
4.3 (medium)
Published
2022-10-17
Title
WP < 6.0.3 - Multiple Stored XSS via Gutenberg
Fixed in
Fixed in 4.0.37
CVSS
3.4 (low)
Published
2022-08-30
Title
WP < 6.0.2 - Reflected Cross-Site Scripting
Fixed in
Fixed in 4.0.36
CVSS
4.7 (medium)
Published
2022-08-30
Title
WP < 6.0.2 - Authenticated Stored Cross-Site Scripting
Fixed in
Fixed in 4.0.36
CVSS
2.6 (low)
Published
2022-08-30
Title
WP < 6.0.2 - SQLi via Link API
Fixed in
Fixed in 4.0.36
CVSS
5.8 (medium)
Published
2022-03-11
Title
WordPress < 5.9.2 - Prototype Pollution in jQuery
Fixed in
Fixed in 4.0.35
CVSS
5.6 (medium)
Published
2022-01-06
Title
WordPress < 5.8.3 - SQL Injection via WP_Query
Fixed in
Fixed in 4.0.34
CVSS
8.6 (high)
Published
2022-01-06
Title
WordPress < 5.8.3 - Author+ Stored XSS via Post Slugs
Fixed in
Fixed in 4.0.34
CVSS
5.4 (medium)
Published
2022-01-06
Title
WordPress < 5.8.3 - Super Admin Object Injection in Multisites
Fixed in
Fixed in 4.0.34
CVSS
3.3 (low)
Published
2021-11-25
Title
WordPress < 5.8 - Plugin Confusion
Fixed in
Fixed in 5.8
CVSS
8.2 (high)