WordPress 6.1 Vulnerabilities

Version released on 2022-11-02

Download tar
Download zip
Published
Title
Fixed in
CVSS
Published
2024-06-24
Title
WordPress < 6.5.5 - Contributor+ Stored XSS in HTML API
Fixed in
Fixed in 6.1.7
CVSS
5.9 (medium)
Published
2024-06-24
Title
WordPress < 6.5.5 - Contributor+ Stored XSS in Template-Part Block
Fixed in
Fixed in 6.1.7
CVSS
5.9 (medium)
Published
2024-06-24
Title
WordPress < 6.5.5 - Contributor+ Path Traversal in Template-Part Block
Fixed in
Fixed in 6.1.7
CVSS
6.8 (medium)
Published
2024-04-09
Title
WP < 6.5.2 - Unauthenticated Stored XSS
Fixed in
Fixed in 6.1.6
CVSS
8.3 (high)
Published
2024-01-30
Title
WordPress < 6.4.3 - Deserialization of Untrusted Data
Fixed in
Fixed in 6.1.5
CVSS
8.5 (high)
Published
2024-01-30
Title
WordPress < 6.4.3 - Admin+ PHP File Upload
Fixed in
Fixed in 6.1.5
CVSS
6.6 (medium)
Published
2023-10-12
Title
WP 5.6-6.3.1 - Contributor+ Stored XSS via Navigation Block
Fixed in
Fixed in 6.1.4
CVSS
5.9 (medium)
Published
2023-10-12
Title
WP 5.6-6.3.1 - Reflected XSS via Application Password Requests
Fixed in
Fixed in 6.1.4
CVSS
7.1 (high)
Published
2023-10-12
Title
WP < 6.3.2 - Denial of Service via Cache Poisoning
Fixed in
Fixed in 6.1.4
CVSS
5.3 (medium)
Published
2023-10-12
Title
WP < 6.3.2 - Subscriber+ Arbitrary Shortcode Execution
Fixed in
Fixed in 6.1.4
CVSS
4.3 (medium)
Published
2023-10-12
Title
WP < 6.3.2 - Contributor+ Comment Disclosure
Fixed in
Fixed in 6.1.4
CVSS
2.7 (low)
Published
2023-10-12
Title
WP < 6.3.2 - Unauthenticated Post Author Email Disclosure
Fixed in
Fixed in 6.1.4
CVSS
5.3 (medium)
Published
2023-05-16
Title
WP < 6.2.1 - Directory Traversal via Translation Files
Fixed in
Fixed in 6.1.2
CVSS
4.8 (medium)
Published
2023-05-16
Title
WP < 6.2.1 - Thumbnail Image Update via CSRF
Fixed in
Fixed in 6.1.2
CVSS
4.3 (medium)
Published
2023-05-16
Title
WP < 6.2.1 - Contributor+ Stored XSS via Open Embed Auto Discovery
Fixed in
Fixed in 6.1.2
CVSS
6.8 (medium)
Published
2023-05-16
Title
WP < 6.2.2 - Shortcode Execution in User Generated Data
Fixed in
Fixed in 6.1.3
CVSS
6.5 (medium)
Published
2023-05-16
Title
WP < 6.2.1 - Contributor+ Content Injection
Fixed in
Fixed in 6.1.2
CVSS
5.5 (medium)
Published
2022-12-13
Title
WP <= 6.2 - Unauthenticated Blind SSRF via DNS Rebinding
Fixed in
No known fix
CVSS
5.4 (medium)