Répertoire de sécurité WordPress
Vulnérabilités du cœur WordPress
Consultez 380 vulnérabilités connues du cœur WordPress, avec CVE, gravité CVSS, versions affectées et correctifs disponibles.
WordPress Core
Failles et CVE du cœur WordPress
WordPress Core 6.9 – 7.0.1 – Remote Code Execution via REST API Batch Request Route Confusion
WordPress Core is vulnerable to Remote Code Execution in all versions 6.9 to 7.0.1 via the REST API batch request endpoint (/wp-json/batch/v1). This is due to a route/validation desynchronization that allows a validated sub-request to be dispatched to…
[6.9, 6.9.5), [7.0, 7.0.2)
6.9.5, 7.0.2
17/07/2026
WordPress Core 6.8 – 7.0.1 – Unauthenticated SQL Injection via author__not_in Parameter
WordPress Core is vulnerable to generic SQL Injection via the 'author__not_in' parameter in versions 6.8 – 7.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes…
[6.8, 6.8.5), [6.9, 6.9.5), [7.0, 7.0.2)
6.8.6, 6.9.5, 7.0.2
17/07/2026
WordPress 6.9 – 6.9.1 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API
WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API…
6.9-6.9.1
6.9.2
10/03/2026
WordPress <= 6.9.1 – Cross-Site Scripting via Client-Side Template Override in Admin Area
WordPress core is vulnerable to Cross-Site Scripting via client-side template overriding in the admin area in all versions up to and including 6.9.1. The `wp.template()` JavaScript function uses `document.getElementById()` to locate templates, which matches any HTML element by…
6.8-6.8.3, 6.9-6.9.1
6.8.4, 6.9.2
10/03/2026
WordPress <= 6.9.1 – Authenticated (Administrator+) Stored Cross-Site Scripting via Navigation Menu Items
WordPress Core is vulnerable to Stored Cross-Site Scripting via admin settings in various versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web…
6.8-6.8.3, 6.9-6.9.1
6.8.4, 6.9.2
10/03/2026
WordPress <= 6.9.1 – Unauthenticated Blind Server-Side Request Forgery via XML-RPC Pingback Discovery
WordPress core is vulnerable to Blind Server-Side Request Forgery in all versions up to and including 6.9.1. This is due to the `WP_HTTP_IXR_Client` class using `wp_remote_post()` instead of the safer `wp_safe_remote_post()` when making outgoing XML-RPC pingback requests. This…
6.8-6.8.3, 6.9-6.9.1
6.8.4, 6.9.2
10/03/2026
WordPress <= 6.9.1 – Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress core is vulnerable to XML External Entity (XXE) Injection via the bundled getID3 library in all versions up to and including 6.9.1. This is due to the `GETID3_LIBXML_OPTIONS` constant including the `LIBXML_NOENT` flag, which enables XML entity…
6.8-6.8.3, 6.9-6.9.1
6.8.4, 6.9.2
10/03/2026
WordPress <= 6.9.1 – Missing Authorization to Authenticated (Author+) Sensitive Information Disclosure via query-attachments AJAX Endpoint
WordPress core is vulnerable to Missing Authorization in all versions up to and including 6.9.1. This is due to a missing capability check on the `uploadedToTitle` and `uploadedToLink` fields in the `wp_prepare_attachment_for_js()` function. When querying media attachments via…
6.8-6.8.3, 6.9-6.9.1
6.8.4, 6.9.2
10/03/2026
WordPress <= 6.8.2 – Authenticated (Author+) Stored Cross-Site Scripting
WordPress Core is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.8.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject…
*-4.7, 4.7-4.7.30, 4.8-4.8.26, 4.9-4.9.27, 5.0-5.0.23, 5.1-5.1.20, 5.2-5.2.22, 5.3-5.3.19, 5.4-5.4.17, 5.5-5.5.16, 5.6-5.6.15, 5.7-5.7.13, 5.8-5.8.11, 5.9-5.9.11, 6.0-6.0.10, 6.1-6.1.8, 6.2-6.2.7, 6.3-6.3.6, 6.4-6.4.6, 6.5-6.5.6, 6.6-6.6.3, 6.7-6.7.3, 6.8-6.8.2
4.7.31, 4.8.27, 4.9.28, 5.0.24, 5.1.21, 5.2.23, 5.3.20, 5.4.18, 5.5.17, 5.6.16, 5.7.14, 5.8.12, 5.9.12, 6.0.11, 6.1.9, 6.2.8, 6.3.7, 6.4.7, 6.5.7, 6.6.4, 6.7.4, 6.8.3
22/09/2025
WordPress <= 6.8.2 – Authenticated (Contributor+) Sensitive Information Exposure
WordPress Core is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.8.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract information from posts they should not have access…
4.7-4.7.30, 4.8-4.8.26, 4.9-4.9.27, 5.0-5.0.23, 5.1-5.1.20, 5.2-5.2.22, 5.3-5.3.19, 5.4-5.4.17, 5.5-5.5.16, 5.6-5.6.15, 5.7-5.7.13, 5.8-5.8.11, 5.9-5.9.11, 6.0-6.0.10, 6.1-6.1.8, 6.2-6.2.7, 6.3-6.3.6, 6.4-6.4.6, 6.5-6.5.6, 6.6-6.6.3, 6.7-6.7.3, 6.8-6.8.2
4.7.31, 4.8.27, 4.9.28, 5.0.24, 5.1.21, 5.2.23, 5.3.20, 5.4.18, 5.5.17, 5.6.16, 5.7.14, 5.8.12, 5.9.12, 6.0.11, 6.1.9, 6.2.8, 6.3.7, 6.4.7, 6.5.7, 6.6.4, 6.7.4, 6.8.3
22/09/2025
WordPress Core < 6.5.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Template Part Block
WordPress Core is vulnerable to Stored Cross-Site Scripting via the Template Part Block in various versions up to 6.5.5 due to insufficient input sanitization and output escaping on the 'tagName' attributes. This makes it possible for authenticated attackers,…
5.9-5.9.9, 6.0-6.0.8, 6.1-6.1.6, 6.2-6.2.5, 6.3-6.3.4, 6.4-6.4.4, 6.5-6.5.4
5.9.10, 6.0.9, 6.1.7, 6.2.6, 6.3.5, 6.4.5, 6.5.5
24/06/2024
WordPress Core < 6.5.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API
WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access…
5.9-5.9.9, 6.0-6.0.8, 6.1-6.1.6, 6.2-6.2.5, 6.3-6.3.4, 6.4-6.4.4, 6.5-6.5.4
5.9.10, 6.0.9, 6.1.7, 6.2.6, 6.3.5, 6.4.5, 6.5.5
24/06/2024
WordPress Core < 6.5.5 – Authenticated (Contributor+) Directory Traversal
WordPress Core is vulnerable to Directory Traversal in various versions up to 6.5.5 via the Template Part block. This makes it possible for authenticated attackers, with Contributor-level access and above, to include arbitrary HTML Files on sites running…
[*, 4.1), 4.1-4.1.40, 4.2-4.2.37, 4.3-4.3.33, 4.4-4.4.32, 4.5-4.5.31, 4.6-4.6.28, 4.7-4.7.28, 4.8-4.8.24, 4.9-4.9.25, 5.0-5.0.21, 5.1-5.1.18, 5.2-5.2.20, 5.3-5.3.17, 5.4-5.4.15, 5.5-5.5.14, 5.6-5.6.13, 5.7-5.7.11, 5.8-5.8.9, 5.9-5.9.9, 6.0-6.0.8, 6.1-6.1.6, 6.2-6.2.5, 6.3-6.3.4, 6.4-6.4.4, 6.5-6.5.4
4.1.41, 4.2.38, 4.3.34, 4.4.33, 4.5.32, 4.6.29, 4.7.29, 4.8.25, 4.9.26, 5.0.22, 5.1.19, 5.2.21, 5.3.18, 5.4.16, 5.5.15, 5.6.14, 5.7.12, 5.8.10, 5.9.10, 6.0.9, 6.1.7, 6.2.6, 6.3.5, 6.4.5, 6.5.5
24/06/2024
WordPress Core < 6.5.2 – Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers,…
6.0-6.0.7, 6.1-6.1.5, 6.2-6.2.4, 6.3-6.3.3, 6.4-6.4.3, 6.5-6.5.1
6.0.8, 6.1.6, 6.2.5, 6.3.4, 6.4.4, 6.5.2
09/04/2024
WordPress Core <= 6.4.3 – Sensitive Information Exposure via redirect_guess_404_permalink
WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been…
*-6.4.3
6.5
04/04/2024
WordPress Core 6.4.0 – 6.4.1 – Remote Code Execution POP Chain
WordPress Core is vulnerable to remote code execution via a PHP gadget in version 6.4.0 and 6.4.1. This is due to there being a magic method __destruct in the WP_HTML_Token class. This makes it possible for attackers to…
6.4.0, 6.4.1
6.4.2
06/12/2023
WordPress Core 5.9-6.3.1 – Authenticated(Contributor+) Stored Cross-Site Scripting via Navigation Attributes
WordPress Core is vulnerable to Stored Cross-Site Scripting via the arrow navigation block attributes in versions between 5.9 and 6.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level privileges…
5.9-5.9.7, 6.0-6.0.5, 6.1-6.1.3, 6.2-6.2.2, 6.3-6.3.1
5.9.8, 6.0.6, 6.1.4, 6.2.3, 6.3.2
12/10/2023
WordPress Core 4.7.0-6.3.1 – Denial of Service via Cache Poisoning
WordPress Core is vulnerable to Denial of Service via Cache Poisoning in versions between 4.7.0 and 6.3.1. In cases where the X-HTTP-Method-Override header was sent in a request to a REST endpoint and the endpoint returned a 4xx…
4.7-4.7.26, 4.8-4.8.22, 4.9-4.9.23, 5.0-5.0.19, 5.1-5.1.16, 5.2-5.2.18, 5.3-5.3.15, 5.4-5.4.13, 5.5-5.5.12, 5.6-5.6.11, 5.7-5.7.9, 5.8-5.8.7, 5.9-5.9.7, 6.0-6.0.5, 6.1-6.1.3, 6.2-6.2.2, 6.3-6.3.1
4.7.27, 4.8.23, 4.9.24, 5.0.20, 5.1.17, 5.2.19, 5.3.16, 5.4.14, 5.5.13, 5.6.12, 5.7.10, 5.8.8, 5.9.8, 6.0.6, 6.1.4, 6.2.3, 6.3.2
12/10/2023
WordPress Core 6.3 – 6.3.1 – Authenticated(Contributor+) Cross-Site Scripting via Footnotes Block
WordPress Core is vulnerable to Stored Cross-Site Scripting via the footnotes block in versions between 6.3 and 6.3.1 due to insufficient input sanitization and output escaping on the footnotes block. This makes it possible for authenticated attackers with…
6.3-6.3.1
6.3.2
12/10/2023
WordPress Core 5.6 – 6.3.1 – Reflected Cross-Site Scripting via Application Password Requests
WordPress Core is vulnerable to Reflected Cross-Site Scripting via the ‘success_url’ and 'reject_url' parameters when requesting application passwords in versions between 5.6 and 6.3.1 due to insufficient input sanitization and output escaping of pseudo protocol URIs. This makes…
5.6-5.6.11, 5.7-5.7.9, 5.8-5.8.7, 5.9-5.9.7, 6.0-6.0.5, 6.1-6.1.3, 6.2-6.2.2, 6.3-6.3.1
5.6.12, 5.7.10, 5.8.8, 5.9.8, 6.0.6, 6.1.4, 6.2.3, 6.3.2
12/10/2023
Comprendre les données
Comment utiliser cet annuaire de vulnérabilités ?
Chaque fiche associe une vulnérabilité à un composant précis, avec sa gravité, les versions affectées et les versions corrigées lorsqu’elles sont connues. Les pages de wordpress servent de point d’entrée pour retrouver rapidement les composants concernés.
Une CVE ne signifie pas automatiquement qu’un site a été compromis. Elle indique qu’une version donnée peut être exposée. La bonne démarche consiste à vérifier l’inventaire réel, sauvegarder, mettre à jour, puis contrôler le fonctionnement et les journaux du site.
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.