Software Detail
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
Number of items displayed
WordPress Number Of NVD 349 CRITICAL 17 HIGH 79 MEDIUM 235 LOW 18
URL https://wordpress.org/
Explanation It is an open source blogging software written in PHP.
It can be used not only for blogs, but also for personal and corporate web sites, and offers a large number of additional features and good-looking themes.
It may be the most used Content Management System (CMS) in the world.

There are many plugins, and if you have enough knowledge, you can build a site that can be used for commercial purposes.
However, since there are some vulnerabilities caused by plugins, you need to carefully select the right plugin to use.

Since security updates are not made for other than the latest version, it is officially announced that older versions cannot be used safely.
In some cases, security issues are fixed for older versions.
Since there are many plugins (additional functions) available for WordPress, you need to check each plugin for vulnerabilities and new versions.
Tag
  • PHP
  • オープンソース
  • GPL v2
Add Information URL
No Type Name URL
1 https://ja.wordpress.org/download/
2 https://github.com/wordpress/wordpress
3 https://wordpress.org/download/releases/
4 https://ja.wordpress.org/download/releases/
5 https://ja.wordpress.org/about/history/
6 https://wordpress.org/news/category/releases/
7 https://ja.wordpress.org/
List Of Product  [ Click to show release history and vulnerability information ]
No Name Latest Version Release date Initial release Normal Support Security Support
Service Pack Support		 Extended
for a fee		 Critical High Medium Low
101 wordpress 6 6.8.3 Sept. 30, 2025 Nov. 2, 2022 0 0 10 0
102 wordpress 5.9 5.9.5 Oct. 17, 2022 Jan. 25, 2022 0 0 10 0
103 wordpress 5.8 5.8.1 Sept. 9, 2021 July 21, 2021 0 3 13 0
104 wordpress 5.7 5.7.3 Sept. 9, 2021 March 10, 2021 2 4 14 0
105 WordPress 5.6 5.6.5 Sept. 9, 2021 Dec. 8, 2020 2 4 14 0
106 WordPress 5.5 5.5.6 Sept. 9, 2021 Aug. 11, 2020 7 5 16 0
107 WordPress 5.4 5.4.7 Sept. 9, 2021 April 28, 2020 7 7 24 2
108 WordPress 5.3 5.3.9 Sept. 11, 2021 Nov. 21, 2019 8 7 27 2
109 WordPress 5.2 5.2.12 Sept. 9, 2021 May 19, 2019 10 9 38 2
110 WordPress 5.1 5.1.11 Sept. 22, 2021 March 11, 2019 10 10 37 2
111 WordPress 5.0 5.0.14 Sept. 22, 2021 Dec. 10, 2018 11 12 43 2
112 WordPress 4.9 4.9.18 May 12, 2021 Nov. 17, 2017 11 17 49 2
113 WordPress 4.8 4.8.17 May 12, 2021 June 23, 2017 13 20 57 2
114 WordPress 4.7 4.7.18 June 11, 2020 Dec. 7, 2016 16 28 72 2
115 WordPress 4.6 4.6.19 June 11, 2020 Aug. 17, 2016 16 26 70 2
116 WordPress 4.5 4.5.22 June 11, 2020 April 14, 2016 16 33 76 2
117 WordPress 4.4 4.4.23 June 11, 2020 Dec. 9, 2015 16 36 78 2
118 WordPress 4.3 4.3.24 June 11, 2020 Aug. 19, 2015 16 36 81 2
119 WordPress 4.2 4.2.28 June 11, 2020 April 28, 2015 16 37 89 3
120 WordPress 4.1 4.1.31 June 11, 2020 Dec. 19, 2014 16 37 91 3
121 wordpress 4.0 4.0.38 Dec. 15, 2014 Dec. 15, 2014 16 37 97 3
122 WordPress 3.9 3.9.40 Nov. 30, 2022 April 17, 2014 16 38 102 4
123 WordPress 3.8 3.8.41 Nov. 30, 2022 Dec. 16, 2013 16 37 102 4
124 WordPress 3.7 3.7.5 Nov. 30, 2022 Oct. 25, 2013 16 37 102 4
125 wordpress 3.6 3.6.1 Sept. 11, 2013 Aug. 1, 2013 Jan. 1, 2000 15 37 94 4
126 wordpress 3.5 3.5.2 June 21, 2013 Nov. 11, 2012 Jan. 1, 2000 15 37 105 4
127 wordpress 3.4 3.4.2 Sept. 6, 2012 June 13, 2012 Jan. 1, 2000 15 37 108 7
128 wordpress 3.3 3.3.3 June 27, 2012 Dec. 12, 2011 Jan. 1, 2000 15 40 119 6
129 wordpress 3.2 3.2.1 July 12, 2011 July 4, 2011 Jan. 1, 2000 15 44 122 5
130 wordpress 3.1 3.1.4 June 29, 2011 Feb. 23, 2011 Jan. 1, 2000 15 44 125 5
131 wordpress 3.0 3.0.6 April 26, 2011 June 17, 2010 Jan. 1, 2000 15 40 132 7
132 wordpress 2.9 2.9.2 Feb. 15, 2010 Dec. 18, 2009 Jan. 1, 2000 15 39 133 7
133 wordpress 2.8 2.8.6 Nov. 12, 2009 June 11, 2009 Jan. 1, 2000 15 41 137 8
134 wordpress 2.7 2.7.1 Feb. 10, 2009 Dec. 10, 2008 Jan. 1, 2000 15 41 140 8
135 wordpress 2.6 2.6.5 Nov. 25, 2008 July 15, 2008 Jan. 1, 2000 15 44 143 8
136 wordpress 2.5 2.5.1 April 25, 2008 March 29, 2008 Jan. 1, 2000 15 46 143 8
137 wordpress 2.3 2.3.3 Feb. 5, 2008 Sept. 25, 2007 Jan. 1, 2000 16 46 147 9
138 wordpress 2.2 2.2.3 Sept. 24, 2007 Sept. 24, 2007 Jan. 1, 2000 16 48 158 9
139 wordpress 2.1 2.1.3 Sept. 24, 2007 Sept. 24, 2007 Jan. 1, 2000 16 51 157 9
140 wordpress 2.0 2.0.9 Sept. 24, 2007 Sept. 24, 2007 Jan. 1, 2000 16 55 180 9
141 wordpress 1.5 1.5.2 Sept. 24, 2007 Sept. 24, 2007 Jan. 1, 2000 16 58 173 8
142 wordpress 1.2 1.2.5 Sept. 24, 2007 Sept. 24, 2007 Jan. 1, 2000 15 55 175 8
143 wordpress 1.6 1.6.2 Jan. 1, 2000 16 49 161 8
144 wordpress 1.3 1.3.3 Jan. 1, 2000 15 49 164 8
145 wordpress 1.1 1.1.1 Jan. 1, 2000 15 49 163 8
146 wordpress 1.0 1.0.2 Sept. 24, 2007 Jan. 1, 2000 15 53 169 8
147 wordpress 0.72 0.72 Jan. 1, 2000 15 51 163 8
148 wordpress 0.711 0.711 Jan. 1, 2000 15 51 163 8
149 wordpress 0.71 0.71 Sept. 24, 2007 Jan. 1, 2000 15 53 167 8
NVD Vulnerability Information
  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW
No CVSS3
CVSS2		 Level
Attach Vector		 Title CWE CVE cpe23Uri or higher or less more than less than Update date
Published date		 Show Affected Exploit
PoC
Search
101 7.5
5.0 		HIGH
Network 		Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components. CWE-22
Path Traversal 		CVE-2017-14719 cpe:2.3:a:wordpress:wordpress:4.8:*
cpe:2.3:a:wordpress:wordpress:4.8.1:*
cpe:2.3:a:wordpress:wordpress:4.7:*
… 		2024-11-21 12:13
2017-09-24 		Show GitHub Exploit DB Packet Storm
102 6.1
4.3 		MEDIUM
Network 		Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. CWE-79
Cross-site Scripting 		CVE-2017-14718 cpe:2.3:a:wordpress:wordpress:*:* 4.8.1 2024-11-21 12:13
2017-09-24 		Show GitHub Exploit DB Packet Storm
103 8.6
5.0 		HIGH
Network 		In WordPress before 4.7.5, there is insufficient redirect validation in the HTTP class, leading to SSRF. CWE-918
Server-Side Request Forgery (SSRF)  		CVE-2017-9066 cpe:2.3:a:wordpress:wordpress:*:* 4.7.4 2024-11-21 12:35
2017-05-18 		Show GitHub Exploit DB Packet Storm
104 7.5
5.0 		HIGH
Network 		In WordPress before 4.7.5, there is a lack of capability checks for post meta data in the XML-RPC API. CWE-20
 Improper Input Validation  		CVE-2017-9065 cpe:2.3:a:wordpress:wordpress:*:* 4.7.4 2024-11-21 12:35
2017-05-18 		Show GitHub Exploit DB Packet Storm
105 8.8
6.8 		HIGH
Network 		In WordPress before 4.7.5, a Cross Site Request Forgery (CSRF) vulnerability exists in the filesystem credentials dialog because a nonce is not required for updating credentials. CWE-352
 Origin Validation Error 		CVE-2017-9064 cpe:2.3:a:wordpress:wordpress:*:* 4.7.4 2024-11-21 12:35
2017-05-18 		Show GitHub Exploit DB Packet Storm
106 6.1
4.3 		MEDIUM
Network 		In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability related to the Customizer exists, involving an invalid customization session. CWE-79
Cross-site Scripting 		CVE-2017-9063 cpe:2.3:a:wordpress:wordpress:*:* 4.7.4 2024-11-21 12:35
2017-05-18 		Show GitHub Exploit DB Packet Storm
107 8.6
5.0 		HIGH
Network 		In WordPress before 4.7.5, there is improper handling of post meta data values in the XML-RPC API. CWE-352
CWE-79
CWE-601
 Origin Validation Error
Cross-site Scripting
Open Redirect 		CVE-2017-9062 cpe:2.3:a:wordpress:wordpress:*:* 4.7.4 2024-11-21 12:35
2017-05-18 		Show GitHub Exploit DB Packet Storm
108 6.1
4.3 		MEDIUM
Network 		In WordPress before 4.7.5, a cross-site scripting (XSS) vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filen… CWE-79
Cross-site Scripting 		CVE-2017-9061 cpe:2.3:a:wordpress:wordpress:*:* 4.7.4 2024-11-21 12:35
2017-05-18 		Show GitHub Exploit DB Packet Storm
109 5.9
4.3 		MEDIUM
Network 		WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?ac… CWE-640
 Weak Password Recovery Mechanism for Forgotten Password 		CVE-2017-8295 cpe:2.3:a:wordpress:wordpress:*:* 4.7.4 2024-11-21 12:33
2017-05-4 		Show GitHub Exploit DB Packet Storm
110 7.5
5.0 		HIGH
Network 		The register_routes function in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in the REST API in WordPress 4.7.x before 4.7.2 does not require an integer identifier, which allows … NVD-CWE-noinfo
CVE-2017-1001000 cpe:2.3:a:wordpress:wordpress:4.7:*
cpe:2.3:a:wordpress:wordpress:4.7.2:*
cpe:2.3:a:wordpress:wordpress:4.7.1:* 		2024-11-21 12:04
2017-04-3 		Show GitHub Exploit DB Packet Storm