Répertoire de sécurité WordPress
Vulnérabilités du cœur WordPress, page 4
Consultez 380 vulnérabilités connues du cœur WordPress, avec CVE, gravité CVSS, versions affectées et correctifs disponibles. Page 4 de l’annuaire.
WordPress Core
Failles et CVE du cœur WordPress
WordPress Core < 5.8.3 – SQL Injection via WP_Query
WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that…
[3.7, 3.7.37), [3.8, 3.8.37), [3.9, 3.9.35), [4.0, 4.0.34), [4.1, 4.1.34), [4.2, 4.2.31), [4.3, 4.3.27), [4.4, 4.4.26), [4.5, 4.5.25), [4.6, 4.6.22), [4.7, 4.7.22), [4.8, 4.8.18), [4.9, 4.9.19), [5.0, 5.0.15), [5.1, 5.1.12), [5.2, 5.2.14), [5.3, 5.3.11), [5.4, 5.4.9), [5.5, 5.5.8), [5.6, 5.6.7), [5.7, 5.7.5), [5.8, 5.8.3)
3.7.37, 3.8.37, 3.9.35, 4.0.34, 4.1.34, 4.2.31, 4.3.27, 4.4.26, 4.5.25, 4.6.22, 4.7.22, 4.8.18, 4.9.19, 5.0.15, 5.1.12, 5.2.14, 5.3.11, 5.4.9, 5.5.8, 5.6.7, 5.7.5, 5.8.3
06/01/2021
WordPress Core < 5.5.2 – Privilege Escalation via XML-RPC
WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.
[*, 3.7), 3.7-3.7.34, 3.8-3.8.34, 3.9-3.9.32, 4.0-4.0.31, 4.1-4.1.31, 4.2-4.2.28, 4.3-4.3.24, 4.4-4.4.23, 4.5-4.5.22, 4.6-4.6.19, 4.7-4.7.18, 4.8-4.8.14, 4.9-4.9.15, 5.0-5.0.10, 5.1-5.1.6, 5.2-5.2.7, 5.3-5.3.4, 5.4-5.4.2, 5.5-5.5.1
3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2
29/10/2020
WordPress Core < 5.5.2 – Spam Embed on Multisite Installations
WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.
[*, 3.7), 3.7-3.7.34, 3.8-3.8.34, 3.9-3.9.32, 4.0-4.0.31, 4.1-4.1.31, 4.2-4.2.28, 4.3-4.3.24, 4.4-4.4.23, 4.5-4.5.22, 4.6-4.6.19, 4.7-4.7.18, 4.8-4.8.14, 4.9-4.9.15, 5.0-5.0.10, 5.1-5.1.6, 5.2-5.2.7, 5.3-5.3.4, 5.4-5.4.2, 5.5-5.5.1
3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2
29/10/2020
WordPress Core < 5.5.2 – Arbitrary File Deletion
is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.
[*, 3.7), 3.7-3.7.34, 3.8-3.8.34, 3.9-3.9.32, 4.0-4.0.31, 4.1-4.1.31, 4.2-4.2.28, 4.3-4.3.24, 4.4-4.4.23, 4.5-4.5.22, 4.6-4.6.19, 4.7-4.7.18, 4.8-4.8.14, 4.9-4.9.15, 5.0-5.0.10, 5.1-5.1.6, 5.2-5.2.7, 5.3-5.3.4, 5.4-5.4.2, 5.5-5.5.1
3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2
29/10/2020
WordPress Core < 5.5.2 – Misconfiguration That Allows Trigger of New Installation
is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the…
[*, 3.7), 3.7-3.7.34, 3.8-3.8.34, 3.9-3.9.32, 4.0-4.0.31, 4.1-4.1.31, 4.2-4.2.28, 4.3-4.3.24, 4.4-4.4.23, 4.5-4.5.22, 4.6-4.6.19, 4.7-4.7.18, 4.8-4.8.14, 4.9-4.9.15, 5.0-5.0.10, 5.1-5.1.6, 5.2-5.2.7, 5.3-5.3.4, 5.4-5.4.2, 5.5-5.5.1
3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2
29/10/2020
WordPress Core < 5.5.2 – Stored Cross-Site Scripting via post slugs
WordPress before 5.5.2 allows stored XSS via post slugs.
[*, 3.7), 3.7-3.7.34, 3.8-3.8.34, 3.9-3.9.32, 4.0-4.0.31, 4.1-4.1.31, 4.2-4.2.28, 4.3-4.3.24, 4.4-4.4.23, 4.5-4.5.22, 4.6-4.6.19, 4.7-4.7.18, 4.8-4.8.14, 4.9-4.9.15, 5.0-5.0.10, 5.1-5.1.6, 5.2-5.2.7, 5.3-5.3.4, 5.4-5.4.2, 5.5-5.5.1
3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2
29/10/2020
WordPress Core < 5.5.2 – Cross-Site Request Forgery to Theme Image Change
WordPress before 5.5.2 allows CSRF attacks that change a theme's background image.
[*, 3.7), 3.7-3.7.34, 3.8-3.8.34, 3.9-3.9.32, 4.0-4.0.31, 4.1-4.1.31, 4.2-4.2.28, 4.3-4.3.24, 4.4-4.4.23, 4.5-4.5.22, 4.6-4.6.19, 4.7-4.7.18, 4.8-4.8.14, 4.9-4.9.15, 5.0-5.0.10, 5.1-5.1.6, 5.2-5.2.7, 5.3-5.3.4, 5.4-5.4.2, 5.5-5.5.1
3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2
29/10/2020
WordPress Core < 5.5.3 – PHP Object Injection Gadget
Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.
[*, 3.7), [3.7, 3.7.35), [3.8, 3.8.35), [3.9, 3.9.33), [4.0, 4.0.32), [4.1, 4.1.32), [4.2, 4.2.29), [4.3, 4.3.25), [4.4, 4.4.24), [4.5, 4.5.23), [4.6, 4.6.20), [4.7, 4.7.19), [4.8, 4.8.15), [4.9, 4.9.16), [5.0, 5.0.11), [5.1, 5.1.8), [5.2, 5.2.9), [5.3, 5.3.6), [5.4, 5.4.4), [5.5, 5.5.3)
3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.8, 5.2.9, 5.3.6, 5.4.4, 5.5.3
29/10/2020
WordPress Core < 5.5.2 – Deserialization Gadget
WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.
[*, 3.7), 3.7-3.7.34, 3.8-3.8.34, 3.9-3.9.32, 4.0-4.0.31, 4.1-4.1.31, 4.2-4.2.28, 4.3-4.3.24, 4.4-4.4.23, 4.5-4.5.22, 4.6-4.6.19, 4.7-4.7.18, 4.8-4.8.14, 4.9-4.9.15, 5.0-5.0.10, 5.1-5.1.6, 5.2-5.2.7, 5.3-5.3.4, 5.4-5.4.2, 5.5-5.5.1
3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2
29/10/2020
WordPress Core < 5.5.2 – Reflected Cross-Site Scripting via Global Variables
WordPress before 5.5.2 allows XSS associated with global variables.
[*, 3.7), 3.7-3.7.34, 3.8-3.8.34, 3.9-3.9.32, 4.0-4.0.31, 4.1-4.1.31, 4.2-4.2.28, 4.3-4.3.24, 4.4-4.4.23, 4.5-4.5.22, 4.6-4.6.19, 4.7-4.7.18, 4.8-4.8.14, 4.9-4.9.15, 5.0-5.0.10, 5.1-5.1.6, 5.2-5.2.7, 5.3-5.3.4, 5.4-5.4.2, 5.5-5.5.1
3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2
29/10/2020
WordPress Core < 5.5.2 – Privilege Escalation via XML-RPC
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.
[*, 3.7), 3.7-3.7.34, 3.8-3.8.34, 3.9-3.9.32, 4.0-4.0.31, 4.1-4.1.31, 4.2-4.2.28, 4.3-4.3.24, 4.4-4.4.23, 4.5-4.5.22, 4.6-4.6.19, 4.7-4.7.18, 4.8-4.8.14, 4.9-4.9.15, 5.0-5.0.10, 5.1-5.1.6, 5.2-5.2.7, 5.3-5.3.4, 5.4-5.4.2, 5.5-5.5.1
3.7.35, 3.8.35, 3.9.33, 4.0.32, 4.1.32, 4.2.29, 4.3.25, 4.4.24, 4.5.23, 4.6.20, 4.7.19, 4.8.15, 4.9.16, 5.0.11, 5.1.7, 5.2.8, 5.3.5, 5.4.3, 5.5.2
29/10/2020
WordPress Core < 5.4.2 – Self-Cross Site Scripting via Theme Folder Name
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to…
[*, 3.7), 3.7-3.7.33, 3.8-3.8.33, 3.9-3.9.31, 4.0-4.0.30, 4.1-4.1.30, 4.2-4.2.27, 4.3-4.3.23, 4.4-4.4.22, 4.5-4.5.21, 4.6-4.6.18, 4.7-4.7.17, 4.8-4.8.13, 4.9-4.9.14, 5.0-5.0.9, 5.1-5.1.5, 5.2-5.2.6, 5.3-5.3.3
3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2
10/06/2020
WordPress Core < 5.4.2 – Open Redirect
In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external link can be crafted leading to unintended/open redirect when clicked. This has been patched in version 5.4.2, along with all the…
[*, 3.7), 3.7-3.7.33, 3.8-3.8.33, 3.9-3.9.31, 4.0-4.0.30, 4.1-4.1.30, 4.2-4.2.27, 4.3-4.3.23, 4.4-4.4.22, 4.5-4.5.21, 4.6-4.6.18, 4.7-4.7.17, 4.8-4.8.13, 4.9-4.9.14, 5.0-5.0.9, 5.1-5.1.5, 5.2-5.2.6, 5.3-5.3.3
3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2
10/06/2020
WordPress Core < 5.4.2 – Arbitrary User Meta Update
In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can…
[*, 3.7), 3.7-3.7.33, 3.8-3.8.33, 3.9-3.9.31, 4.0-4.0.30, 4.1-4.1.30, 4.2-4.2.27, 4.3-4.3.23, 4.4-4.4.22, 4.5-4.5.21, 4.6-4.6.18, 4.7-4.7.17, 4.8-4.8.13, 4.9-4.9.14, 5.0-5.0.9, 5.1-5.1.5, 5.2-5.2.6, 5.3-5.3.3
3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2
10/06/2020
WordPress Core < 5.4.2 – Comment Disclosure
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.
[*, 3.7), 3.7-3.7.33, 3.8-3.8.33, 3.9-3.9.31, 4.0-4.0.30, 4.1-4.1.30, 4.2-4.2.27, 4.3-4.3.23, 4.4-4.4.22, 4.5-4.5.21, 4.6-4.6.18, 4.7-4.7.17, 4.8-4.8.13, 4.9-4.9.14, 5.0-5.0.9, 5.1-5.1.5, 5.2-5.2.6, 5.3-5.3.3
3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2
10/06/2020
WordPress Core < 5.4.2 – Authenticated Stored Cross-Site Scripting
In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher…
[*, 3.7), 3.7-3.7.33, 3.8-3.8.33, 3.9-3.9.31, 4.0-4.0.30, 4.1-4.1.30, 4.2-4.2.27, 4.3-4.3.23, 4.4-4.4.22, 4.5-4.5.21, 4.6-4.6.18, 4.7-4.7.17, 4.8-4.8.13, 4.9-4.9.14, 5.0-5.0.9, 5.1-5.1.5, 5.2-5.2.6, 5.3-5.3.3
3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2
10/06/2020
WordPress Core < 5.4.2 – Authenticated Stored Cross-Site Scripting
In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScript into some media file attachment pages in a certain way. This can lead to script execution in the context of a…
[*, 3.7), 3.7-3.7.33, 3.8-3.8.33, 3.9-3.9.31, 4.0-4.0.30, 4.1-4.1.30, 4.2-4.2.27, 4.3-4.3.23, 4.4-4.4.22, 4.5-4.5.21, 4.6-4.6.18, 4.7-4.7.17, 4.8-4.8.13, 4.9-4.9.14, 5.0-5.0.9, 5.1-5.1.5, 5.2-5.2.6, 5.3-5.3.3
3.7.34, 3.8.34, 3.9.32, 4.0.31, 4.1.31, 4.2.28, 4.3.24, 4.4.23, 4.5.22, 4.6.19, 4.7.18, 4.8.14, 4.9.15, 5.0.10, 5.1.6, 5.2.7, 5.3.4, 5.4.2
10/06/2020
WordPress Core < 5.4.1 – Private Post Disclosure
In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via…
[*, 3.7), 3.7-3.7.32, 3.8-3.8.32, 3.9-3.9.30, 4.0-4.0.29, 4.1-4.1.29, 4.2-4.2.26, 4.3-4.3.22, 4.4-4.4.21, 4.5-4.5.20, 4.6-4.6.17, 4.7-4.7.16, 4.8-4.8.12, 4.9-4.9.13, 5.0-5.0.8, 5.1-5.1.4, 5.2-5.2.5, 5.3-5.3.2, 5.4
3.7.33, 3.8.33, 3.9.31, 4.0.30, 4.1.30, 4.2.27, 4.3.23, 4.4.22, 4.5.21, 4.6.18, 4.7.17, 4.8.13, 4.9.14, 5.0.9, 5.1.5, 5.2.6, 5.3.3, 5.4.1
29/04/2020
WordPress Core < 5.4.1 – Authenticated Cross-Site Scripting via Customizer
In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the…
[*, 3.7), 3.7-3.7.32, 3.8-3.8.32, 3.9-3.9.30, 4.0-4.0.29, 4.1-4.1.29, 4.2-4.2.26, 4.3-4.3.22, 4.4-4.4.21, 4.5-4.5.20, 4.6-4.6.17, 4.7-4.7.16, 4.8-4.8.12, 4.9-4.9.13, 5.0-5.0.8, 5.1-5.1.4, 5.2-5.2.5, 5.3-5.3.2, 5.4
3.7.33, 3.8.33, 3.9.31, 4.0.30, 4.1.30, 4.2.27, 4.3.23, 4.4.22, 4.5.21, 4.6.18, 4.7.17, 4.8.13, 4.9.14, 5.0.9, 5.1.5, 5.2.6, 5.3.3, 5.4.1
29/04/2020
WordPress Core < 5.4.1 – Reflected Cross Site Scripting
In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a…
[*, 3.7), 3.7-3.7.32, 3.8-3.8.32, 3.9-3.9.30, 4.0-4.0.29, 4.1-4.1.29, 4.2-4.2.26, 4.3-4.3.22, 4.4-4.4.21, 4.5-4.5.20, 4.6-4.6.17, 4.7-4.7.16, 4.8-4.8.12, 4.9-4.9.13, 5.0-5.0.8, 5.1-5.1.4, 5.2-5.2.5, 5.3-5.3.2, 5.4
3.7.33, 3.8.33, 3.9.31, 4.0.30, 4.1.30, 4.2.27, 4.3.23, 4.4.22, 4.5.21, 4.6.18, 4.7.17, 4.8.13, 4.9.14, 5.0.9, 5.1.5, 5.2.6, 5.3.3, 5.4.1
29/04/2020
Comprendre les données
Comment utiliser cet annuaire de vulnérabilités ?
Chaque fiche associe une vulnérabilité à un composant précis, avec sa gravité, les versions affectées et les versions corrigées lorsqu’elles sont connues. Les pages de wordpress servent de point d’entrée pour retrouver rapidement les composants concernés.
Une CVE ne signifie pas automatiquement qu’un site a été compromis. Elle indique qu’une version donnée peut être exposée. La bonne démarche consiste à vérifier l’inventaire réel, sauvegarder, mettre à jour, puis contrôler le fonctionnement et les journaux du site.
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.