WordPress Archives - Standoutmedia A/S

element that passes KSES and give it an Interactivity API binding (data-wp-bind–data) that replaces the element’s data attribute at render time, pointing it at an arbitrary URL such as an admin page when an administrator views the post. Fixed in WordPress 7.1.4, which drops such bindings at save time and when the directives are processed.

This vulnerability affects the following application versions:

WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.6.10
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.7.10
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.8.10
WordPress 6.8.11
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 6.9.10
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.0.7
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2
WordPress 7.1.3

Incorrect Permissions for Notes in WordPress REST Comments Endpoint

Skrevet den 29. oktober 2026 af i WordPress

The WordPress REST API comments endpoint let any user holding the moderate_comments capability update or delete a note (the block editor’s editorial comments, comment type ‘note’) without checking that they can edit the post the note belongs to. A user whose role can moderate comments but cannot edit a given post could therefore read, change and delete the private editorial notes attached to it. Fixed upstream in WordPress 7.1.4, 7.0.8 and 6.9.11.

This vulnerability affects the following application versions:

WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 6.9.10
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.0.7
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2
WordPress 7.1.3

Authenticated (Contributor+) Stored Cross-Site Scripting via WordPress Categories Block Label

Skrevet den 29. oktober 2026 af i WordPress

WordPress 6.7 through 7.1.3 built the Categories block’s dropdown markup by concatenating the block’s label attribute into the sprintf() format string. A Contributor could store a Categories block whose label contains printf conversion specifiers (such as %1$s or %2$s), which KSES keeps as plain text; when the block is rendered, sprintf() expands them into the wrapper attributes or the dropdown markup, which contain quotes and tags, breaking out of an HTML attribute and injecting script into every page that shows the block. Version 7.1.4 (and 7.0.8, 6.9.11, 6.8.12, 6.7.11) passes the label as a separate sprintf() argument instead.

This vulnerability affects the following application versions:

WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.7.10
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.8.10
WordPress 6.8.11
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 6.9.10
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.0.7
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2
WordPress 7.1.3

Stored Cross-Site Scripting in WordPress Comments Pagination and Post Navigation Link block labels

Skrevet den 29. oktober 2026 af i WordPress

A user with Contributor access or higher can put HTML into the label of a Comments Pagination Next/Previous or Post Navigation Link block. The blocks’ server-side render callbacks printed the label without escaping, so the markup ends up in the page served to every visitor. Fixed upstream in WordPress 7.1.4 and the matching security releases of the 5.9-7.0 branches.

This vulnerability affects the following application versions:

WordPress 5.9
WordPress 5.9.1
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.18
WordPress 5.9.19
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.17
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.14
WordPress 6.1.15
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.13
WordPress 6.2.14
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.12
WordPress 6.3.13
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.13
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.13
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.6.10
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.7.10
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.8.10
WordPress 6.8.11
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 6.9.10
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.0.7
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2
WordPress 7.1.3

Stored XSS via unsafe preg_replace() replacements in WordPress Image lightbox and Playlist blocks

Skrevet den 29. oktober 2026 af i WordPress

The Image block’s lightbox renderer and the Playlist block inserted markup with preg_replace() and used block-derived HTML as the replacement string, so $0, or $1 sequences in a user-authored image tag or playlist waveform setting were expanded into a copy of the tag’s own markup. That breaks the attribute quoting and lets a Contributor turn part of an attribute value into new attributes of the rendered tag. WordPress 7.1.4 inserts the markup with the HTML API instead.

This vulnerability affects the following application versions:

WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.13
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.13
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.6.10
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.7.10
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.8.10
WordPress 6.8.11
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 6.9.10
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.0.7
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2
WordPress 7.1.3

Stored Cross-Site Scripting in WordPress Interactivity Router via Uploaded Text Files

Skrevet den 29. oktober 2026 af i WordPress

A user with the Author role or higher could upload a .txt file containing HTML markup and point the Interactivity API client-side router at it, for example through a link with a navigate directive. The router fetched the file and injected its markup into the current page as if it were an HTML page, regardless of the text/plain content type. Fixed in WordPress 7.1.4, which only fetches same-origin URLs and only processes successful same-origin text/html responses.

This vulnerability affects the following application versions:

WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.13
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.6.10
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.7.10
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.8.10
WordPress 6.8.11
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 6.9.10
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.0.7
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2
WordPress 7.1.3

Stored Cross-Site Scripting and DoS in WordPress Interactivity API Runtime

Skrevet den 29. oktober 2026 af i WordPress

Users with the Contributor role or above could store Interactivity API directives in post content that the client-side runtime processed unsafely: javascript: URLs and on* event-handler attributes through data-wp-bind, prototype pollution through data-wp-context JSON, directive names and namespaces, and post-content elements shadowing the Interactivity script-module data by ID. Anyone viewing the post, including administrators, could have attacker-controlled script run in their browser, or the page’s interactive blocks could stop working. Fixed in WordPress 7.1.4 and the matching 7.0.8 … 6.4.14 branch releases.

This vulnerability affects the following application versions:

WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.13
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.13
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.6.10
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.7.10
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.8.10
WordPress 6.8.11
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 6.9.10
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.0.7
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2
WordPress 7.1.3

Stored Cross-Site Scripting in WordPress Personal Data Request Screens

Skrevet den 29. oktober 2026 af i WordPress

WordPress printed the requester e-mail address of personal data export and erasure requests without HTML escaping in the Tools > Export Personal Data and Erase Personal Data list tables (link text and the row checkbox label). A user with the Editor role or higher who can store a request with markup in the e-mail field can run script in an administrator’s session when the requests screen is opened.

This vulnerability affects the following application versions:

WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 4.9.32
WordPress 4.9.33
WordPress 4.9.34
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0.29
WordPress 5.0.30
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.26
WordPress 5.1.27
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.28
WordPress 5.2.29
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.24
WordPress 5.3.25
WordPress 5.3.26
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.22
WordPress 5.4.23
WordPress 5.4.24
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.21
WordPress 5.5.22
WordPress 5.5.23
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.20
WordPress 5.6.21
WordPress 5.6.22
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.18
WordPress 5.7.19
WordPress 5.7.2
WordPress 5.7.20
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.16
WordPress 5.8.17
WordPress 5.8.18
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.18
WordPress 5.9.19
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.17
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.14
WordPress 6.1.15
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.13
WordPress 6.2.14
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.12
WordPress 6.3.13
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.13
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.13
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.10
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.10
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.10
WordPress 6.8.11
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.10
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.0.7
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2
WordPress 7.1.3

Authenticated (Contributor+) Stored Cross-Site Scripting via WordPress Customizer Selective Refresh

Skrevet den 29. oktober 2026 af i WordPress

WordPress before 7.1.4 resolved Customizer selective-refresh partial placements by concatenating the partial ID into a jQuery selector passed to $(), and built widget containers from before_widget/after_widget markup taken from the partial parameters. Because partials and their parameters can be declared with data-customize-partial-* attributes inside post content, a Contributor could craft content that breaks out of the selector or makes jQuery parse attacker markup as HTML when an administrator previews it in the Customizer, running script in the administrator session. Version 7.1.4 escapes the partial ID, resolves placements only as selectors via $( document ).find(), and takes widget container markup from the registered sidebar instead.

This vulnerability affects the following application versions:

WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.36
WordPress 4.7.37
WordPress 4.7.38
WordPress 4.7.39
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.8.31
WordPress 4.8.32
WordPress 4.8.33
WordPress 4.8.34
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 4.9.32
WordPress 4.9.33
WordPress 4.9.34
WordPress 4.9.35
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0.29
WordPress 5.0.30
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.26
WordPress 5.1.27
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.28
WordPress 5.2.29
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.24
WordPress 5.3.25
WordPress 5.3.26
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.22
WordPress 5.4.23
WordPress 5.4.24
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.21
WordPress 5.5.22
WordPress 5.5.23
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.20
WordPress 5.6.21
WordPress 5.6.22
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.18
WordPress 5.7.19
WordPress 5.7.2
WordPress 5.7.20
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.16
WordPress 5.8.17
WordPress 5.8.18
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.18
WordPress 5.9.19
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.17
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.14
WordPress 6.1.15
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.13
WordPress 6.2.14
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.12
WordPress 6.3.13
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.13
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.13
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.10
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.10
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.10
WordPress 6.8.11
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.10
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.0.7
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2
WordPress 7.1.3

Remote Code Execution via Race Condition in the WordPress Upgrade Working Directory

Skrevet den 29. oktober 2026 af i WordPress

WordPress unpacked update packages into a predictably named, web-served directory under wp-content/upgrade/. While an update was running, an unauthenticated attacker could reach the unpacked files and get a wp-config.php written into that directory copied over the site’s configuration, which can lead to remote code execution. The fix gives the working directory an unpredictable name, keeps the upgrade directory from being listed, and never copies a wp-config.php during a core update.

This vulnerability affects the following application versions:

WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.36
WordPress 4.7.37
WordPress 4.7.38
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.31
WordPress 4.8.32
WordPress 4.8.33
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 4.9.32
WordPress 4.9.33
WordPress 4.9.34
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0.29
WordPress 5.0.30
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.26
WordPress 5.1.27
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.28
WordPress 5.2.29
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.24
WordPress 5.3.25
WordPress 5.3.26
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.22
WordPress 5.4.23
WordPress 5.4.24
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.21
WordPress 5.5.22
WordPress 5.5.23
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.20
WordPress 5.6.21
WordPress 5.6.22
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.18
WordPress 5.7.19
WordPress 5.7.2
WordPress 5.7.20
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.16
WordPress 5.8.17
WordPress 5.8.18
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.18
WordPress 5.9.19
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.17
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.14
WordPress 6.1.15
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.13
WordPress 6.2.14
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.12
WordPress 6.3.13
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.13
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.13
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.10
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.10
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.10
WordPress 6.8.11
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.10
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.0.7
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2
WordPress 7.1.3

Unescaped User Login and Display Name Output in WordPress User Management Screens

Skrevet den 29. oktober 2026 af i WordPress

WordPress printed user_login and display_name values without HTML escaping on the Users and Network Users list tables, the delete and remove user confirmation screens, the user profile screen, the admin bar, the add-user AJAX response and the multisite signup confirmation. A user record whose login or display name carries markup (for example one written by a plugin or import that bypasses WordPress’s own input sanitisation) could inject HTML into an administrator’s screens. WordPress 7.1.4 fixes this as hardening on every branch back to 4.7.

This vulnerability affects the following application versions:

WordPress 3.5
WordPress 3.5.1
WordPress 3.5.2
WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.36
WordPress 4.7.37
WordPress 4.7.38
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.8.31
WordPress 4.8.32
WordPress 4.8.33
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 4.9.32
WordPress 4.9.33
WordPress 4.9.34
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0.29
WordPress 5.0.30
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.26
WordPress 5.1.27
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.28
WordPress 5.2.29
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.24
WordPress 5.3.25
WordPress 5.3.26
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.22
WordPress 5.4.23
WordPress 5.4.24
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.21
WordPress 5.5.22
WordPress 5.5.23
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.20
WordPress 5.6.21
WordPress 5.6.22
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.18
WordPress 5.7.19
WordPress 5.7.2
WordPress 5.7.20
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.16
WordPress 5.8.17
WordPress 5.8.18
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.18
WordPress 5.9.19
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.17
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.14
WordPress 6.1.15
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.13
WordPress 6.2.14
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.12
WordPress 6.3.13
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.13
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.13
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.10
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.10
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.10
WordPress 6.8.11
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.10
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.0.7
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2
WordPress 7.1.3

Information Disclosure of Unpublished Changesets in WordPress Customizer

Skrevet den 29. oktober 2026 af i WordPress

WordPress 4.9 through 7.1.3 auto-load the most recent unpublished (draft, pending or scheduled) Customizer changeset for a customize-preview request that carries no changeset UUID, without checking the current user’s capabilities. An unauthenticated visitor can therefore preview the site rendered with another user’s staged, unpublished Customizer settings. Fixed in WordPress 7.1.4 by requiring the customize capability before the latest changeset is auto-loaded.

This vulnerability affects the following application versions:

WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 4.9.32
WordPress 4.9.33
WordPress 4.9.34
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0.29
WordPress 5.0.30
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.26
WordPress 5.1.27
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.28
WordPress 5.2.29
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.24
WordPress 5.3.25
WordPress 5.3.26
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.22
WordPress 5.4.23
WordPress 5.4.24
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.21
WordPress 5.5.22
WordPress 5.5.23
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.20
WordPress 5.6.21
WordPress 5.6.22
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.18
WordPress 5.7.19
WordPress 5.7.2
WordPress 5.7.20
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.16
WordPress 5.8.17
WordPress 5.8.18
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.18
WordPress 5.9.19
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.17
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.14
WordPress 6.1.15
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.13
WordPress 6.2.14
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.12
WordPress 6.3.13
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.13
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.13
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.10
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.10
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.10
WordPress 6.8.11
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.10
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.0.7
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2
WordPress 7.1.3

Authenticated (Contributor+) Stored Cross-Site Scripting via WordPress Block Delimiter Whitespace

Skrevet den 29. oktober 2026 af i WordPress

WordPress before 7.1.4 matched the whitespace inside block comment delimiters () with the regex class s, which accepts a different set of characters in the server-side PHP block parser (PCRE, which includes the vertical tab) than in the block editor JavaScript parser (which includes NBSP and other Unicode spaces). A Contributor could store a delimiter that the server treats as a plain HTML comment, so its block attributes skip the server-side KSES filtering, while the block editor parses it as a real block when an administrator opens the post, running script in the administrator session. Version 7.1.4 accepts only HTML whitespace (space, tab, form feed, carriage return, line feed) in block delimiters in both parsers.

This vulnerability affects the following application versions:

WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0.29
WordPress 5.0.30
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.26
WordPress 5.1.27
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.28
WordPress 5.2.29
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.24
WordPress 5.3.25
WordPress 5.3.26
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.22
WordPress 5.4.23
WordPress 5.4.24
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.21
WordPress 5.5.22
WordPress 5.5.23
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.20
WordPress 5.6.21
WordPress 5.6.22
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.18
WordPress 5.7.19
WordPress 5.7.2
WordPress 5.7.20
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.16
WordPress 5.8.17
WordPress 5.8.18
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.18
WordPress 5.9.19
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.17
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.14
WordPress 6.1.15
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.13
WordPress 6.2.14
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.12
WordPress 6.3.13
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.13
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.13
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.10
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.10
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.10
WordPress 6.8.11
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.10
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.0.7
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2
WordPress 7.1.3

Stored Cross-Site Scripting in WordPress Comments Screen Contextual Help Tabs

Skrevet den 8. oktober 2026 af i WordPress

The admin contextual help tab handler passed a link’s href straight to jQuery, which parses markup-like values as HTML instead of treating them as a selector. Content from a pending comment could use this to run script in the browser of an administrator or moderator viewing the Comments screen. The fix resolves the help panel with $( document ).find( href ), which only ever treats the value as a selector.

This vulnerability affects the following application versions:

WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.36
WordPress 4.7.37
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.8.31
WordPress 4.8.32
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 4.9.32
WordPress 4.9.33
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0.29
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.26
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.28
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.24
WordPress 5.3.25
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.22
WordPress 5.4.23
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.21
WordPress 5.5.22
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.20
WordPress 5.6.21
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.18
WordPress 5.7.19
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.16
WordPress 5.8.17
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.18
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.14
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.13
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.12
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.10
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2

Denial of Service in WordPress HTTP API Relative URL Resolution

Skrevet den 8. oktober 2026 af i WordPress

WP_Http::make_absolute_url() can enter an infinite loop when resolving a crafted relative path (for example one containing an empty segment before ‘../’). A hostile remote server can return such a path in a redirect Location header, tying up PHP workers until max_execution_time and degrading site availability.

This vulnerability affects the following application versions:

WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.36
WordPress 4.7.37
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.8.31
WordPress 4.8.32
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 4.9.32
WordPress 4.9.33
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0.29
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.26
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.28
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.24
WordPress 5.3.25
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.22
WordPress 5.4.23
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.21
WordPress 5.5.22
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.20
WordPress 5.6.21
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.18
WordPress 5.7.19
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.16
WordPress 5.8.17
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.18
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.14
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.13
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.12
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.10
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2

Second-Order SQL Injection in WordPress Export

Skrevet den 8. oktober 2026 af i WordPress

The WXR export (Tools > Export) merges raw _thumbnail_id post meta values into a list of post IDs that is later interpolated unprepared into an SQL IN () clause. A lower-privileged user who can store a crafted _thumbnail_id value can get SQL executed when an administrator runs an export.

This vulnerability affects the following application versions:

WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.8.10
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2

Unauthenticated Disclosure of Comments on Private Posts in WordPress Comment Feeds

Skrevet den 8. oktober 2026 af i WordPress

WordPress loaded and output approved comments in a singular comment feed before checking whether the visitor may read the post. An unauthenticated visitor could read comments on private, draft or otherwise unpublished posts by requesting the post’s comment feed.

This vulnerability affects the following application versions:

WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.36
WordPress 4.7.37
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.8.31
WordPress 4.8.32
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 4.9.32
WordPress 4.9.33
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0.29
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.26
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.28
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.24
WordPress 5.3.25
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.22
WordPress 5.4.23
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.21
WordPress 5.5.22
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.20
WordPress 5.6.21
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.18
WordPress 5.7.19
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.16
WordPress 5.8.17
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.18
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.14
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.13
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.12
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.10
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2

Incorrect Sticky Post Permission Check in WordPress REST API

Skrevet den 8. oktober 2026 af i WordPress

The REST API posts controller allowed changing a post’s sticky status when the user had either the edit_others_posts or publish_posts capability, instead of requiring both. Authors could therefore pin their own posts to the top of the front page, an action reserved for Editors and above.

This vulnerability affects the following application versions:

WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.36
WordPress 4.7.37
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.8.31
WordPress 4.8.32
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 4.9.32
WordPress 4.9.33
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0.29
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.26
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.28
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.24
WordPress 5.3.25
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.22
WordPress 5.4.23
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.21
WordPress 5.5.22
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.20
WordPress 5.6.21
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.18
WordPress 5.7.19
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.16
WordPress 5.8.17
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.18
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.14
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.13
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.12
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.10
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2

Stored Cross-Site Scripting via Imgur oEmbeds in WordPress

Skrevet den 8. oktober 2026 af i WordPress

WordPress treated Imgur as a trusted oEmbed provider and embedded its returned HTML without sanitization. Markup an attacker could place in Imgur’s oEmbed response executed in the browser of anyone viewing a page where that Imgur URL was embedded.

This vulnerability affects the following application versions:

WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.36
WordPress 4.7.37
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.8.31
WordPress 4.8.32
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.30
WordPress 4.9.31
WordPress 4.9.32
WordPress 4.9.33
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0.29
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.26
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.28
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.24
WordPress 5.3.25
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.22
WordPress 5.4.23
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.21
WordPress 5.5.22
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.20
WordPress 5.6.21
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.18
WordPress 5.7.19
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.16
WordPress 5.8.17
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.18
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.14
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.13
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.12
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.10
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2

Action Name Collision via Forgeable Post Status Transition Hooks in WordPress

Skrevet den 8. oktober 2026 af i WordPress

WordPress fired the dynamic {old}_to_{new} and {status}_{post_type} actions for any status and post type string, registered or not. A caller-influenced status or post type could build the name of an unrelated action and trigger its callbacks with the post’s arguments.

This vulnerability affects the following application versions:

WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.36
WordPress 4.7.37
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.8.31
WordPress 4.8.32
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 4.9.32
WordPress 4.9.33
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0.29
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.26
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.28
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.24
WordPress 5.3.25
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.22
WordPress 5.4.23
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.21
WordPress 5.5.22
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.20
WordPress 5.6.21
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.18
WordPress 5.7.19
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.16
WordPress 5.8.17
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.18
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.14
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.13
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.12
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.10
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 6.9.9
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.0.6
WordPress 7.1
WordPress 7.1.1
WordPress 7.1.2

Path Traversal leading to Local File Inclusion in WordPress Page Template Resolution

Skrevet den 23. september 2026 af i WordPress

An unauthenticated attacker can make WordPress page-template resolution (get_page_template/locate_template) include a readable local PHP file outside the active theme directories. On sites whose active theme has a top-level directory starting with ‘page-‘ (e.g. Twenty Twelve, Twenty Fourteen, Neve, Hestia, Sydney) and a suitable PHP file on the server, this can lead to remote code execution.

This vulnerability affects the following application versions:

WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.36
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.8.31
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 4.9.32
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.24
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.22
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.21
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.20
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.18
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.16
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 6.9.8
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.0.5
WordPress 7.1
WordPress 7.1.1

Privilege Escalation via Arbitrary Post Overwrite in WordPress

Skrevet den 22. september 2026 af i WordPress

_wp_translate_postdata() applies its per-post capability checks (edit_post / edit_others_posts / edit_published_posts) only on the update path. On the create path it passed the submitted post data straight through, including a caller-supplied ID, and wp_insert_post() treats a supplied ID as the row to write. A Contributor-level user could therefore send a create request carrying the ID of any existing post or page and overwrite it, because none of the capability checks run on that path. The fix rejects a non-empty ID whenever the update flag is false – legitimate post creation never carries one.

This vulnerability affects the following application versions:

WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.1

HTML Comment Breakout in WordPress HTML API

Skrevet den 22. september 2026 af i WordPress

WP_HTML_Tag_Processor::set_modifiable_text() guarded comment text only against the –> and –!> closers, missing the abrupt closers the HTML specification also honours: a leading > or -> at the very start of the comment text. Text beginning with either sequence escaped the comment and was parsed as markup, so a caller placing untrusted content inside an HTML comment could have that content injected into the page. The fix extends the guard to /^-?>|–!?>/ so abrupt closers are rejected as well.

This vulnerability affects the following application versions:

WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.1

Path Traversal in WordPress Block Template File Resolution

Skrevet den 22. september 2026 af i WordPress

The block template resolver _get_block_template_file() built a template path by concatenating a caller-supplied slug onto the active theme’s template directory and accepted the result on nothing more than a file_exists() check. A slug containing traversal sequences therefore resolved outside the theme’s template directory, so an authenticated user who can reach the REST templates controller could have the contents of arbitrary .html files readable by the web server returned as template content. The fix canonicalises both the candidate file and the template directory with realpath() and requires the resolved file to sit under the resolved template directory before the template is accepted, storing the canonicalised path.

This vulnerability affects the following application versions:

WordPress 5.9
WordPress 5.9.1
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.3.10
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.4.10
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.5.10
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.1

Stored Cross-Site Scripting in WordPress wpautop() Blockquote Handling

Skrevet den 22. september 2026 af i WordPress

WordPress core’s wpautop() rewrote a

-wrapped

using an attribute pattern that stopped at the first > character, so a quoted attribute value containing > was split and part of the attacker-supplied string was re-emitted unescaped into the rewritten tag. Because wpautop() is applied to comment content, an unauthenticated visitor can store JavaScript that executes in the browser of anyone viewing the post once the comment is published. Fixed by consuming quoted attribute values as part of the attribute run.

This vulnerability affects the following application versions:

WordPress 3.6

WordPress 3.6.1

WordPress 3.7

WordPress 3.7.1

WordPress 3.7.2

WordPress 3.7.3

WordPress 3.7.4

WordPress 3.7.5

WordPress 3.7.6

WordPress 3.7.7

WordPress 3.7.8

WordPress 3.7.9

WordPress 3.7.10

WordPress 3.7.11

WordPress 3.7.12

WordPress 3.7.13

WordPress 3.7.14

WordPress 3.7.15

WordPress 3.7.16

WordPress 3.7.17

WordPress 3.7.18

WordPress 3.7.19

WordPress 3.7.20

WordPress 3.7.21

WordPress 3.7.22

WordPress 3.7.23

WordPress 3.7.24

WordPress 3.7.25

WordPress 3.7.26

WordPress 3.7.27

WordPress 3.7.28

WordPress 3.7.29

WordPress 3.7.30

WordPress 3.7.31

WordPress 3.7.32

WordPress 3.7.33

WordPress 3.7.34

WordPress 3.7.35

WordPress 3.7.36

WordPress 3.7.37

WordPress 3.7.38

WordPress 3.7.39

WordPress 3.7.40

WordPress 3.7.41

WordPress 3.8

WordPress 3.8.1

WordPress 3.8.2

WordPress 3.8.3

WordPress 3.8.4

WordPress 3.8.5

WordPress 3.8.6

WordPress 3.8.7

WordPress 3.8.8

WordPress 3.8.9

WordPress 3.8.10

WordPress 3.8.11

WordPress 3.8.12

WordPress 3.8.13

WordPress 3.8.14

WordPress 3.8.15

WordPress 3.8.16

WordPress 3.8.17

WordPress 3.8.18

WordPress 3.8.19

WordPress 3.8.20

WordPress 3.8.21

WordPress 3.8.22

WordPress 3.8.23

WordPress 3.8.24

WordPress 3.8.25

WordPress 3.8.26

WordPress 3.8.27

WordPress 3.8.28

WordPress 3.8.29

WordPress 3.8.30

WordPress 3.8.31

WordPress 3.8.32

WordPress 3.8.33

WordPress 3.8.34

WordPress 3.8.35

WordPress 3.8.36

WordPress 3.8.37

WordPress 3.8.38

WordPress 3.8.39

WordPress 3.8.40

WordPress 3.8.41

WordPress 3.9

WordPress 3.9.1

WordPress 3.9.2

WordPress 3.9.3

WordPress 3.9.4

WordPress 3.9.5

WordPress 3.9.6

WordPress 3.9.7

WordPress 3.9.8

WordPress 3.9.9

WordPress 3.9.10

WordPress 3.9.11

WordPress 3.9.12

WordPress 3.9.13

WordPress 3.9.14

WordPress 3.9.15

WordPress 3.9.16

WordPress 3.9.17

WordPress 3.9.18

WordPress 3.9.19

WordPress 3.9.20

WordPress 3.9.21

WordPress 3.9.22

WordPress 3.9.23

WordPress 3.9.24

WordPress 3.9.25

WordPress 3.9.26

WordPress 3.9.27

WordPress 3.9.28

WordPress 3.9.29

WordPress 3.9.30

WordPress 3.9.31

WordPress 3.9.32

WordPress 3.9.33

WordPress 3.9.34

WordPress 3.9.35

WordPress 3.9.36

WordPress 3.9.37

WordPress 3.9.39

WordPress 3.9.40

WordPress 4.0

WordPress 4.0.1

WordPress 4.0.2

WordPress 4.0.3

WordPress 4.0.4

WordPress 4.0.5

WordPress 4.0.6

WordPress 4.0.7

WordPress 4.0.8

WordPress 4.0.9

WordPress 4.0.10

WordPress 4.0.11

WordPress 4.0.12

WordPress 4.0.13

WordPress 4.0.14

WordPress 4.0.15

WordPress 4.0.16

WordPress 4.0.17

WordPress 4.0.18

WordPress 4.0.19

WordPress 4.0.20

WordPress 4.0.21

WordPress 4.0.22

WordPress 4.0.23

WordPress 4.0.24

WordPress 4.0.25

WordPress 4.0.26

WordPress 4.0.27

WordPress 4.0.28

WordPress 4.0.29

WordPress 4.0.30

WordPress 4.0.31

WordPress 4.0.32

WordPress 4.0.33

WordPress 4.0.34

WordPress 4.0.35

WordPress 4.0.36

WordPress 4.0.37

WordPress 4.0.38

WordPress 4.1

WordPress 4.1.1

WordPress 4.1.2

WordPress 4.1.3

WordPress 4.1.4

WordPress 4.1.5

WordPress 4.1.6

WordPress 4.1.7

WordPress 4.1.8

WordPress 4.1.9

WordPress 4.1.10

WordPress 4.1.11

WordPress 4.1.12

WordPress 4.1.13

WordPress 4.1.14

WordPress 4.1.15

WordPress 4.1.16

WordPress 4.1.17

WordPress 4.1.18

WordPress 4.1.19

WordPress 4.1.20

WordPress 4.1.21

WordPress 4.1.22

WordPress 4.1.23

WordPress 4.1.24

WordPress 4.1.25

WordPress 4.1.26

WordPress 4.1.27

WordPress 4.1.28

WordPress 4.1.29

WordPress 4.1.30

WordPress 4.1.31

WordPress 4.1.32

WordPress 4.1.33

WordPress 4.1.34

WordPress 4.1.35

WordPress 4.1.36

WordPress 4.1.37

WordPress 4.1.38

WordPress 4.1.39

WordPress 4.1.40

WordPress 4.1.41

WordPress 4.1.42

WordPress 4.2

WordPress 4.2.1

WordPress 4.2.2

WordPress 4.2.3

WordPress 4.2.4

WordPress 4.2.5

WordPress 4.2.6

WordPress 4.2.7

WordPress 4.2.8

WordPress 4.2.9

WordPress 4.2.10

WordPress 4.2.11

WordPress 4.2.12

WordPress 4.2.13

WordPress 4.2.14

WordPress 4.2.15

WordPress 4.2.16

WordPress 4.2.17

WordPress 4.2.18

WordPress 4.2.19

WordPress 4.2.20

WordPress 4.2.21

WordPress 4.2.22

WordPress 4.2.23

WordPress 4.2.24

WordPress 4.2.25

WordPress 4.2.26

WordPress 4.2.27

WordPress 4.2.28

WordPress 4.2.29

WordPress 4.2.30

WordPress 4.2.31

WordPress 4.2.32

WordPress 4.2.33

WordPress 4.2.34

WordPress 4.2.35

WordPress 4.2.36

WordPress 4.2.37

WordPress 4.2.38

WordPress 4.2.39

WordPress 4.3

WordPress 4.3.1

WordPress 4.3.2

WordPress 4.3.3

WordPress 4.3.4

WordPress 4.3.5

WordPress 4.3.6

WordPress 4.3.7

WordPress 4.3.8

WordPress 4.3.9

WordPress 4.3.10

WordPress 4.3.11

WordPress 4.3.12

WordPress 4.3.13

WordPress 4.3.14

WordPress 4.3.15

WordPress 4.3.16

WordPress 4.3.17

WordPress 4.3.18

WordPress 4.3.19

WordPress 4.3.20

WordPress 4.3.21

WordPress 4.3.22

WordPress 4.3.23

WordPress 4.3.24

WordPress 4.3.25

WordPress 4.3.26

WordPress 4.3.27

WordPress 4.3.28

WordPress 4.3.29

WordPress 4.3.30

WordPress 4.3.31

WordPress 4.3.32

WordPress 4.3.33

WordPress 4.3.34

WordPress 4.3.35

WordPress 4.4

WordPress 4.4.1

WordPress 4.4.2

WordPress 4.4.3

WordPress 4.4.4

WordPress 4.4.5

WordPress 4.4.6

WordPress 4.4.7

WordPress 4.4.8

WordPress 4.4.9

WordPress 4.4.10

WordPress 4.4.11

WordPress 4.4.12

WordPress 4.4.13

WordPress 4.4.14

WordPress 4.4.15

WordPress 4.4.16

WordPress 4.4.17

WordPress 4.4.18

WordPress 4.4.19

WordPress 4.4.20

WordPress 4.4.21

WordPress 4.4.22

WordPress 4.4.23

WordPress 4.4.24

WordPress 4.4.25

WordPress 4.4.26

WordPress 4.4.27

WordPress 4.4.28

WordPress 4.4.29

WordPress 4.4.30

WordPress 4.4.31

WordPress 4.4.32

WordPress 4.4.33

WordPress 4.4.34

WordPress 4.5

WordPress 4.5.1

WordPress 4.5.2

WordPress 4.5.3

WordPress 4.5.4

WordPress 4.5.5

WordPress 4.5.6

WordPress 4.5.7

WordPress 4.5.8

WordPress 4.5.9

WordPress 4.5.10

WordPress 4.5.11

WordPress 4.5.12

WordPress 4.5.13

WordPress 4.5.14

WordPress 4.5.15

WordPress 4.5.16

WordPress 4.5.17

WordPress 4.5.18

WordPress 4.5.19

WordPress 4.5.20

WordPress 4.5.21

WordPress 4.5.22

WordPress 4.5.23

WordPress 4.5.24

WordPress 4.5.25

WordPress 4.5.26

WordPress 4.5.27

WordPress 4.5.28

WordPress 4.5.29

WordPress 4.5.30

WordPress 4.5.31

WordPress 4.5.32

WordPress 4.5.33

WordPress 4.6

WordPress 4.6.1

WordPress 4.6.2

WordPress 4.6.3

WordPress 4.6.4

WordPress 4.6.5

WordPress 4.6.6

WordPress 4.6.7

WordPress 4.6.8

WordPress 4.6.9

WordPress 4.6.10

WordPress 4.6.11

WordPress 4.6.12

WordPress 4.6.13

WordPress 4.6.14

WordPress 4.6.15

WordPress 4.6.16

WordPress 4.6.17

WordPress 4.6.18

WordPress 4.6.19

WordPress 4.6.20

WordPress 4.6.21

WordPress 4.6.22

WordPress 4.6.23

WordPress 4.6.24

WordPress 4.6.25

WordPress 4.6.26

WordPress 4.6.27

WordPress 4.6.28

WordPress 4.6.29

WordPress 4.6.30

WordPress 4.7

WordPress 4.7.1

WordPress 4.7.2

WordPress 4.7.3

WordPress 4.7.4

WordPress 4.7.5

WordPress 4.7.10

WordPress 4.7.11

WordPress 4.7.12

WordPress 4.7.13

WordPress 4.7.14

WordPress 4.7.15

WordPress 4.7.16

WordPress 4.7.17

WordPress 4.7.18

WordPress 4.7.19

WordPress 4.7.20

WordPress 4.7.21

WordPress 4.7.22

WordPress 4.7.23

WordPress 4.7.24

WordPress 4.7.25

WordPress 4.7.26

WordPress 4.7.27

WordPress 4.7.28

WordPress 4.7.29

WordPress 4.7.30

WordPress 4.7.31

WordPress 4.7.32

WordPress 4.7.33

WordPress 4.7.34

WordPress 4.7.35

WordPress 4.7.6

WordPress 4.7.7

WordPress 4.7.8

WordPress 4.7.9

WordPress 4.8

WordPress 4.8.1

WordPress 4.8.2

WordPress 4.8.3

WordPress 4.8.4

WordPress 4.8.5

WordPress 4.8.6

WordPress 4.8.7

WordPress 4.8.8

WordPress 4.8.9

WordPress 4.8.10

WordPress 4.8.11

WordPress 4.8.12

WordPress 4.8.13

WordPress 4.8.14

WordPress 4.8.15

WordPress 4.8.16

WordPress 4.8.17

WordPress 4.8.18

WordPress 4.8.19

WordPress 4.8.20

WordPress 4.8.21

WordPress 4.8.22

WordPress 4.8.23

WordPress 4.8.24

WordPress 4.8.25

WordPress 4.8.26

WordPress 4.8.27

WordPress 4.8.28

WordPress 4.8.29

WordPress 4.8.30

WordPress 4.9

WordPress 4.9.1

WordPress 4.9.2

WordPress 4.9.10

WordPress 4.9.11

WordPress 4.9.12

WordPress 4.9.13

WordPress 4.9.14

WordPress 4.9.15

WordPress 4.9.16

WordPress 4.9.17

WordPress 4.9.18

WordPress 4.9.19

WordPress 4.9.20

WordPress 4.9.21

WordPress 4.9.22

WordPress 4.9.23

WordPress 4.9.3

WordPress 4.9.4

WordPress 4.9.5

WordPress 4.9.6

WordPress 4.9.7

WordPress 4.9.8

WordPress 4.9.9

WordPress 4.9.24

WordPress 4.9.25

WordPress 4.9.26

WordPress 4.9.27

WordPress 4.9.28

WordPress 4.9.29

WordPress 4.9.30

WordPress 4.9.31

WordPress 5.0

WordPress 5.0.1

WordPress 5.0.2

WordPress 5.0.3

WordPress 5.0.4

WordPress 5.0.6

WordPress 5.0.7

WordPress 5.0.8

WordPress 5.0.9

WordPress 5.0.10

WordPress 5.0.11

WordPress 5.0.12

WordPress 5.0.13

WordPress 5.0.14

WordPress 5.0.15

WordPress 5.0.16

WordPress 5.0.17

WordPress 5.0.18

WordPress 5.0.19

WordPress 5.0.20

WordPress 5.0.21

WordPress 5.0.22

WordPress 5.0.23

WordPress 5.0.24

WordPress 5.0.25

WordPress 5.0.26

WordPress 5.0.27

WordPress 5.0 Beta 1

WordPress 5.0 Beta 2

WordPress 5.0 Beta 3

WordPress 5.0 Beta 4

WordPress 5.0 RC1

WordPress 5.0 RC2

WordPress 5.0 RC3

WordPress 5.1

WordPress 5.1.1

WordPress 5.1.10

WordPress 5.1.11

WordPress 5.1.12

WordPress 5.1.13

WordPress 5.1.14

WordPress 5.1.15

WordPress 5.1.16

WordPress 5.1.17

WordPress 5.1.18

WordPress 5.1.19

WordPress 5.1.2

WordPress 5.1.20

WordPress 5.1.21

WordPress 5.1.22

WordPress 5.1.23

WordPress 5.1.24

WordPress 5.1.3

WordPress 5.1.4

WordPress 5.1.5

WordPress 5.1.6

WordPress 5.1.7

WordPress 5.1.8

WordPress 5.1.9

WordPress 5.2

WordPress 5.2.1

WordPress 5.2.10

WordPress 5.2.11

WordPress 5.2.12

WordPress 5.2.13

WordPress 5.2.14

WordPress 5.2.15

WordPress 5.2.16

WordPress 5.2.17

WordPress 5.2.18

WordPress 5.2.19

WordPress 5.2.2

WordPress 5.2.20

WordPress 5.2.21

WordPress 5.2.22

WordPress 5.2.23

WordPress 5.2.24

WordPress 5.2.25

WordPress 5.2.26

WordPress 5.2.3

WordPress 5.2.4

WordPress 5.2.5

WordPress 5.2.6

WordPress 5.2.7

WordPress 5.2.8

WordPress 5.2.9

WordPress 5.2 Beta 1

WordPress 5.2 Beta 2

WordPress 5.3

WordPress 5.3.1

WordPress 5.3.10

WordPress 5.3.11

WordPress 5.3.12

WordPress 5.3.13

WordPress 5.3.14

WordPress 5.3.15

WordPress 5.3.16

WordPress 5.3.17

WordPress 5.3.18

WordPress 5.3.19

WordPress 5.3.2

WordPress 5.3.20

WordPress 5.3.21

WordPress 5.3.22

WordPress 5.3.23

WordPress 5.3.3

WordPress 5.3.4

WordPress 5.3.5

WordPress 5.3.6

WordPress 5.3.7

WordPress 5.3.8

WordPress 5.3.9

WordPress 5.4

WordPress 5.4.1

WordPress 5.4.10

WordPress 5.4.11

WordPress 5.4.12

WordPress 5.4.13

WordPress 5.4.14

WordPress 5.4.15

WordPress 5.4.16

WordPress 5.4.17

WordPress 5.4.18

WordPress 5.4.19

WordPress 5.4.2

WordPress 5.4.20

WordPress 5.4.21

WordPress 5.4.3

WordPress 5.4.4

WordPress 5.4.5

WordPress 5.4.6

WordPress 5.4.7

WordPress 5.4.8

WordPress 5.4.9

WordPress 5.5

WordPress 5.5.1

WordPress 5.5.10

WordPress 5.5.11

WordPress 5.5.12

WordPress 5.5.13

WordPress 5.5.14

WordPress 5.5.15

WordPress 5.5.16

WordPress 5.5.17

WordPress 5.5.18

WordPress 5.5.19

WordPress 5.5.2

WordPress 5.5.20

WordPress 5.5.3

WordPress 5.5.4

WordPress 5.5.5

WordPress 5.5.6

WordPress 5.5.7

WordPress 5.5.8

WordPress 5.5.9

WordPress 5.6

WordPress 5.6.1

WordPress 5.6.10

WordPress 5.6.11

WordPress 5.6.12

WordPress 5.6.13

WordPress 5.6.14

WordPress 5.6.15

WordPress 5.6.16

WordPress 5.6.17

WordPress 5.6.18

WordPress 5.6.19

WordPress 5.6.2

WordPress 5.6.3

WordPress 5.6.4

WordPress 5.6.5

WordPress 5.6.6

WordPress 5.6.7

WordPress 5.6.8

WordPress 5.6.9

WordPress 5.7

WordPress 5.7.1

WordPress 5.7.10

WordPress 5.7.11

WordPress 5.7.12

WordPress 5.7.13

WordPress 5.7.14

WordPress 5.7.15

WordPress 5.7.16

WordPress 5.7.17

WordPress 5.7.2

WordPress 5.7.3

WordPress 5.7.4

WordPress 5.7.5

WordPress 5.7.6

WordPress 5.7.7

WordPress 5.7.8

WordPress 5.7.9

WordPress 5.8

WordPress 5.8.1

WordPress 5.8.10

WordPress 5.8.11

WordPress 5.8.12

WordPress 5.8.13

WordPress 5.8.14

WordPress 5.8.15

WordPress 5.8.2

WordPress 5.8.3

WordPress 5.8.4

WordPress 5.8.5

WordPress 5.8.6

WordPress 5.8.7

WordPress 5.8.8

WordPress 5.8.9

WordPress 5.9

WordPress 5.9.1

WordPress 5.9.10

WordPress 5.9.11

WordPress 5.9.12

WordPress 5.9.13

WordPress 5.9.14

WordPress 5.9.15

WordPress 5.9.16

WordPress 5.9.2

WordPress 5.9.3

WordPress 5.9.4

WordPress 5.9.5

WordPress 5.9.6

WordPress 5.9.7

WordPress 5.9.8

WordPress 5.9.9

WordPress 6.0

WordPress 6.0.1

WordPress 6.0.10

WordPress 6.0.11

WordPress 6.0.12

WordPress 6.0.13

WordPress 6.0.14

WordPress 6.0.2

WordPress 6.0.3

WordPress 6.0.4

WordPress 6.0.5

WordPress 6.0.6

WordPress 6.0.7

WordPress 6.0.8

WordPress 6.0.9

WordPress 6.1

WordPress 6.1.1

WordPress 6.1.10

WordPress 6.1.11

WordPress 6.1.12

WordPress 6.1.2

WordPress 6.1.3

WordPress 6.1.4

WordPress 6.1.5

WordPress 6.1.6

WordPress 6.1.7

WordPress 6.1.8

WordPress 6.1.9

WordPress 6.2

WordPress 6.2.1

WordPress 6.2.10

WordPress 6.2.11

WordPress 6.2.2

WordPress 6.2.3

WordPress 6.2.4

WordPress 6.2.5

WordPress 6.2.6

WordPress 6.2.7

WordPress 6.2.8

WordPress 6.2.9

WordPress 6.3

WordPress 6.3.1

WordPress 6.3.10

WordPress 6.3.2

WordPress 6.3.3

WordPress 6.3.4

WordPress 6.3.5

WordPress 6.3.6

WordPress 6.3.7

WordPress 6.3.8

WordPress 6.3.9

WordPress 6.4

WordPress 6.4.1

WordPress 6.4.10

WordPress 6.4.2

WordPress 6.4.3

WordPress 6.4.4

WordPress 6.4.5

WordPress 6.4.6

WordPress 6.4.7

WordPress 6.4.8

WordPress 6.4.9

WordPress 6.5

WordPress 6.5.10

WordPress 6.5.2

WordPress 6.5.3

WordPress 6.5.4

WordPress 6.5.5

WordPress 6.5.6

WordPress 6.5.7

WordPress 6.5.8

WordPress 6.5.9

WordPress 6.6

WordPress 6.6.1

WordPress 6.6.2

WordPress 6.6.3

WordPress 6.6.4

WordPress 6.6.5

WordPress 6.6.6

WordPress 6.6.7

WordPress 6.7

WordPress 6.7.1

WordPress 6.7.2

WordPress 6.7.3

WordPress 6.7.4

WordPress 6.7.5

WordPress 6.7.6

WordPress 6.7.7

WordPress 6.8

WordPress 6.8.1

WordPress 6.8.2

WordPress 6.8.3

WordPress 6.8.4

WordPress 6.8.5

WordPress 6.8.6

WordPress 6.8.7

WordPress 6.8.8

WordPress 6.9

WordPress 6.9.1

WordPress 6.9.2

WordPress 6.9.3

WordPress 6.9.4

WordPress 6.9.5

WordPress 6.9.6

WordPress 6.9.7

WordPress 7.0

WordPress 7.0.1

WordPress 7.0.2

WordPress 7.0.3

WordPress 7.0.4

WordPress 7.1

Missing Authorization Checks in WordPress Admin AJAX Endpoints

Skrevet den 22. september 2026 af i WordPress

Three WordPress admin AJAX handlers performed no per-object authorization check. On multisite, a Site Administrator could network-activate a plugin the network administrator had reserved as Network-only, because wp_ajax_activate_plugin() never verified the manage_network_plugins capability and is_network_only_plugin() resolved its argument differently from activate_plugin(), so the plugin header was frequently not read at all. Separately, any user at Contributor level or above could read back the permalink – and therefore the slug – of other users’ draft and pending posts via wp_ajax_get_permalink() and wp_ajax_sample_permalink(), which validated only a shared nonce before generating the link.

This vulnerability affects the following application versions:

WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.1

Incorrect Permissions in WordPress REST Comments Endpoint

Skrevet den 22. september 202630. oktober 2026 af i WordPress

The WordPress REST API comments endpoint did not authorize the destination post when a request changed a comment’s or note’s parent post – it only verified that the user could edit the post the comment was moving away from. An authenticated user who is allowed to edit their own comment or note could therefore reparent it onto any post on the site, including posts they can neither read nor edit, attaching arbitrary content (and, for notes, editorial content) where they have no access.

This vulnerability affects the following application versions:

WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.36
WordPress 4.7.37
WordPress 4.7.38
WordPress 4.7.39
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.8.31
WordPress 4.8.32
WordPress 4.8.33
WordPress 4.8.34
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 4.9.32
WordPress 4.9.33
WordPress 4.9.34
WordPress 4.9.35
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0.29
WordPress 5.0.30
WordPress 5.0.31
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.26
WordPress 5.1.27
WordPress 5.1.28
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.28
WordPress 5.2.29
WordPress 5.2.3
WordPress 5.2.30
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.1

Private parent post title disclosed in WordPress attachment details

Skrevet den 22. september 2026 af i WordPress

The attachment details screen in wp-admin rendered the title of an attachment’s parent post after checking only that the parent existed, without testing whether the current user was allowed to read it. Any user able to view an attachment therefore learned the title of its parent post, even when that post was private and otherwise inaccessible to them. The fix adds a read_post capability check on the parent post before the “Uploaded to” row is rendered.

This vulnerability affects the following application versions:

WordPress 5.6
WordPress 5.6.1
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.3.10
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.4.10
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.5.10
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.1

Privilege Escalation in WordPress XML-RPC Changeset Writes

Skrevet den 22. september 2026 af i WordPress

The XML-RPC methods wp.newPost and wp.editPost accepted any registered post type, including internal-only builtin types such as customize_changeset. Those types are normally written through dedicated helpers that enforce their own capability rules – for customize_changeset, the edit_css / unfiltered_css checks that gate Additional CSS. Writing the changeset through the generic XML-RPC post API skipped those helpers, letting an authenticated user without the custom CSS capability stage CSS by crafting the changeset content directly. The fix rejects XML-RPC writes to internal-only builtin post types with a 403.

This vulnerability affects the following application versions:

WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.1

Authenticated (Administrator+) Stored Cross-Site Scripting via WordPress Custom Header Image Data

Skrevet den 22. september 2026 af i WordPress

WordPress before 7.1.1 stored the header_image_data theme mod exactly as supplied through the Customizer, because WP_Customize_Header_Image_Setting had no sanitize() implementation, so a user who can edit theme options could persist arbitrary keys and types. The stored width, height and thumbnail_url were then emitted by themes and by the admin header preview without escaping, letting that user run script in the browser of anyone viewing an affected page. Version 7.1.1 rebuilds the value member by member, escapes the preview style attribute, and casts the dimensions with absint().

This vulnerability affects the following application versions:

WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.1

Improper Input Validation in WordPress Theme Installer Preview Route

Skrevet den 22. september 2026 af i WordPress

The WordPress theme installer took the theme slug straight from the URL and interpolated it into a jQuery attribute selector without escaping. A slug carrying selector metacharacters escapes the intended selector and matches elements the author never intended, so a crafted URL can drive a click onto the install and preview controls and cause a theme to be installed and previewed from WordPress.org without the administrator choosing it. Version 7.1.1 escapes the slug with jQuery escapeSelector() and narrows the selector so it can only match a theme tile.

This vulnerability affects the following application versions:

WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 6.9.7
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3
WordPress 7.0.4
WordPress 7.1

Remote Code Execution via malicious file upload in WP_Image_Editor_Imagick

Skrevet den 14. august 2026 af i WordPress

An attacker holding the upload_files capability (Author role or higher) can upload a file that Imagick delegates to Ghostscript for PostScript/PDF rasterization. WP_Image_Editor_Imagick::load() decided how to treat an uploaded file purely from its filename extension, so a file with an image-looking extension – or one carrying an Imagick FORMAT: prefix – could still be parsed as PostScript, reach Ghostscript, and execute code on any server where both Imagick and Ghostscript are installed.

This vulnerability affects the following application versions:

WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 6.9.6
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2
WordPress 7.0.3

Stored Cross-Site Scripting in WordPress Emoji Loader Settings

Skrevet den 12. august 2026 af i WordPress

The emoji loader read its configuration from an element resolved with document.getElementById( ‘wp-emoji-settings’ ). Post content authored by a Contributor-level user can inject an element with that id (DOM clobbering), so the loader parses attacker-controlled JSON, including the script URLs it subsequently loads. This lets a Contributor execute arbitrary JavaScript in the browser of any visitor who views the post.

This vulnerability affects the following application versions:

WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2

Stored Cross-Site Scripting in WordPress Post Content Block

Skrevet den 12. august 2026 af i WordPress

The Post Content block used any tagName block attribute as its wrapper element as long as it survived tag_escape(), which only strips characters that are invalid in a tag name. An authenticated user with Contributor privileges or higher could therefore set the wrapper tag to script and have arbitrary JavaScript executed in the browser of every visitor viewing the post. The fix restricts the wrapper tag to an allowlist of div, main, section and article.

This vulnerability affects the following application versions:

WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2

Stored Cross-Site Scripting in WordPress Quick Edit Author Dropdown

Skrevet den 12. august 2026 af i WordPress

On sites with enough users that the post author is missing from the Quick Edit author dropdown, WordPress built the extra

This vulnerability affects the following application versions:

WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.2
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2

Contributor+ stored XSS in the Post Date block

Skrevet den 12. august 2026 af i WordPress

Render_block_core_post_date() interpolated the raw and formatted post date directly into a element and, when the block is configured as a link, the permalink into an . The href moreover used the malformed %1s / %2s placeholders instead of %1$s / %2$s, so the substitution did not behave as intended. The fix escapes each value at the point of output — esc_attr() on the datetime attribute, esc_html() on the visible date, esc_url() on the permalink — and corrects the sprintf() placeholders.

This vulnerability affects the following application versions:

WordPress 5.8
WordPress 5.8.1
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.1.10
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2

CSS Injection in WordPress Safe CSS Attribute Filter

Skrevet den 12. august 2026 af i WordPress

WordPress’ safe CSS attribute filter (safecss_filter_attr()) fails open: when the recursive preg_replace() used to strip url()/var()/calc() from a test copy of a declaration hits a PCRE backtracking or recursion limit it returns null, and the follow-up preg_match() returns false, which the code read as ‘no dangerous characters found’. A crafted style declaration is therefore allowed precisely when the filter could not analyse it. An authenticated user with Author-level access or higher can inject arbitrary CSS into published content, enabling defacement, UI redressing and CSS-based data exfiltration.

This vulnerability affects the following application versions:

WordPress 3.5
WordPress 3.5.1
WordPress 3.5.2
WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.2
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2

Disclosure of private notes in comment feeds

Skrevet den 12. august 202623. september 2026 af i WordPress

Comment feeds selected every approved row from the comments table without filtering on comment type, so internal notes (comment_type of note), which are not intended to be publicly visible, were published in the archive, search, front-page and single-post comment feeds. The fix adds AND {$wpdb->comments}.comment_type != ‘note’ to all three $cwhere clauses in WP_Query::get_posts() and WP_Query::the_comments().

This vulnerability affects the following application versions:

WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.7.34
WordPress 4.7.35
WordPress 4.7.36
WordPress 4.7.37
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.8.29
WordPress 4.8.30
WordPress 4.8.31
WordPress 4.8.32
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 4.9.30
WordPress 4.9.31
WordPress 4.9.32
WordPress 4.9.33
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0.26
WordPress 5.0.27
WordPress 5.0.28
WordPress 5.0.29
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.23
WordPress 5.1.24
WordPress 5.1.25
WordPress 5.1.26
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.25
WordPress 5.2.26
WordPress 5.2.27
WordPress 5.2.28
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.22
WordPress 5.3.23
WordPress 5.3.24
WordPress 5.3.25
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.20
WordPress 5.4.21
WordPress 5.4.22
WordPress 5.4.23
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.19
WordPress 5.5.2
WordPress 5.5.20
WordPress 5.5.21
WordPress 5.5.22
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.18
WordPress 5.6.19
WordPress 5.6.2
WordPress 5.6.20
WordPress 5.6.21
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.16
WordPress 5.7.17
WordPress 5.7.18
WordPress 5.7.19
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.14
WordPress 5.8.15
WordPress 5.8.16
WordPress 5.8.17
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.14
WordPress 5.9.15
WordPress 5.9.16
WordPress 5.9.17
WordPress 5.9.18
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.11
WordPress 6.1.12
WordPress 6.1.13
WordPress 6.1.14
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.10
WordPress 6.2.11
WordPress 6.2.12
WordPress 6.2.13
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.10
WordPress 6.3.11
WordPress 6.3.12
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.3.9
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.10
WordPress 6.4.11
WordPress 6.4.12
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.4.9
WordPress 6.5
WordPress 6.5.10
WordPress 6.5.11
WordPress 6.5.12
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.5.9
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.6.6
WordPress 6.6.7
WordPress 6.6.8
WordPress 6.6.9
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.7.6
WordPress 6.7.7
WordPress 6.7.8
WordPress 6.7.9
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.10
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.8.7
WordPress 6.8.8
WordPress 6.8.9
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2

Information disclosure in the Latest Comments block comments on password-protected posts

Skrevet den 12. august 2026 af i WordPress

With displayExcerpt set to full content, render_block_core_latest_comments() rendered get_comment_text() for every recent comment regardless of the parent post’s protection state, so any unauthenticated visitor could read the discussion on a password-protected post from the block output. The fix checks post_password_required( $comment->comment_post_ID ) and substitutes the “Password protected” placeholder instead of the comment body. (The excerpt branch already went through get_comment_excerpt(), which performs its own check.)

This vulnerability affects the following application versions:

WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2

Post slug enumeration via the 404 canonical redirect guesser

Skrevet den 12. august 2026 af i WordPress

In redirect_guess_404_permalink(), the query-var branch that handles an array of post types built its post_type IN (…) clause from the raw get_query_var( ‘post_type’ ) value rather than from $post_types, the list already filtered down to publicly viewable types a few lines above. An unauthenticated visitor could therefore supply non-public post types in the request and have the redirect guesser confirm or deny the existence of their slugs. The fix passes the filtered $post_types array to esc_sql() so the clause matches the authorisation check that precedes it.

This vulnerability affects the following application versions:

WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.2
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2

Privilege Escalation in WordPress Multisite Site Registration

Skrevet den 12. august 2026 af i WordPress

On WordPress multisite networks configured to allow user registration but not site creation, the site-signup stage of wp-signup.php did not consult the network’s registration setting before validating a new-site request. Any registered user could POST directly to that stage and create a new site, bypassing the restriction set by the network administrator. Only multisite installations with user registration enabled are affected.

This vulnerability affects the following application versions:

WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.2
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2

Reflected Cross-Site Scripting in WordPress Login Screen

Skrevet den 12. august 2026 af i WordPress

An unauthenticated attacker can inject arbitrary HTML/JavaScript into the WordPress login and registration screens by submitting a crafted username or email address, which was reflected back into the authentication error messages without escaping. Successful exploitation runs in the victim’s browser session and can be escalated toward PHP code execution when an administrator is targeted. The same fix also closes an email address confirmation bypass in which send_confirmation_on_profile_email() trusted $_POST[‘user_id’] without verifying that any user was logged in.

This vulnerability affects the following application versions:

WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.2
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2

Server-Side Request Forgery in WordPress URL Validation

Skrevet den 12. august 2026 af i WordPress

wp_http_validate_url() rejected only a small set of private IPv4 ranges, so a host resolving to 169.254.0.0/16 or another reserved range was treated as a valid external host. Features that fetch a user-supplied URL could therefore reach link-local and other internal-only endpoints, including cloud instance metadata services. The fix extends the reject list to link-local, CGNAT, IETF/TEST-NET, benchmarking, multicast and reserved ranges.

This vulnerability affects the following application versions:

WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.7.32
WordPress 4.7.33
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.8.28
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.29
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0.25
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.22
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.24
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.21
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.19
WordPress 5.4.2
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.18
WordPress 5.5.2
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.17
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.15
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.13
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.13
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.10
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.2.9
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.3.8
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.4.8
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.5.8
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.6.5
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.7.5
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.8.6
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 6.9.5
WordPress 7.0
WordPress 7.0.1
WordPress 7.0.2

SQL injection in the author__not_in parameter of WP_Query

Skrevet den 21. juli 202622. juli 2026 af i WordPress

WordPress 6.8+ builds the post_author NOT IN (…) clause in WP_Query from author__not_in but only sanitises the value when it is already an array u2014 a scalar (reachable via the REST author_exclude parameter) skips absint() and is injected straight into the SQL. From 6.9+ this chains with the REST batch-route confusion (CVE-2026-63030) for pre-auth Remote Code Execution.

This vulnerability affects the following application versions:

WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 7.0
WordPress 7.0.1

Unauthenticated REST API batch-route confusion leading to Remote Code Execution

Skrevet den 21. juli 202622. juli 2026 af i WordPress

WordPress 6.9.0u20136.9.4 and 7.0.0u20137.0.1 fail to add a placeholder to the batch handler’s $matches array when a REST sub-request errors, desynchronising it from the validation array so a later sub-request runs with the wrong route’s permission callback. Chained with the companion author_exclude SQL injection (CVE-2026-60137), an unauthenticated attacker can escalate to administrator and reach pre-auth Remote Code Execution (“wp2shell”).

This vulnerability affects the following application versions:

WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.8.4
WordPress 6.8.5
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3
WordPress 6.9.4
WordPress 7.0
WordPress 7.0.1

A PoP-chain weakness in the HTML API

Skrevet den 20. marts 2026 af i WordPress

The WP_HTML_Tag_Processor class in WordPress does not implement a __wakeup() method to prevent unserialization. This allows the class to be used as a gadget in a PHP Object Injection (PoP) chain attack. If an attacker can trigger unserialization of untrusted data (e.g. through a vulnerable plugin), the WP_HTML_Tag_Processor class could be exploited to execute arbitrary code. The fix adds a __wakeup() method that throws a LogicException, preventing the class from being unserialized.

This vulnerability affects the following application versions:

WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.9
WordPress 6.9.1

Authenticated (Administrator+) Stored Cross-Site Scripting via Navigation Menu Items

Skrevet den 20. marts 202630. oktober 2026 af i WordPress

WordPress Core is vulnerable to Stored Cross-Site Scripting via admin settings in various versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

This vulnerability affects the following application versions:

WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.2
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.2
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.17
WordPress 6.0.18
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.9
WordPress 6.9.1

Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload

Skrevet den 20. marts 2026 af i WordPress

WordPress core is vulnerable to XML External Entity (XXE) Injection via the bundled getID3 library in all versions up to and including 6.9.1. This is due to the `GETID3_LIBXML_OPTIONS` constant including the `LIBXML_NOENT` flag, which enables XML entity substitution during parsing. When WordPress processes media files containing XML metadata (specifically iXML chunks in WAV/RIFF/AVI files), the getID3 library parses the XML with entity substitution enabled, allowing local file disclosure via `file://` protocol URIs. This may make it possible for authenticated attackers with Author-level access to read arbitrary files from the server.

This vulnerability affects the following application versions:

WordPress 6.1
WordPress 6.1.1
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.9
WordPress 6.9.1
WordPress 6.9.2
WordPress 6.9.3

Information Disclosure in WordPress media

Skrevet den 20. marts 202630. oktober 2026 af i WordPress

A missing authorization vulnerability allows authenticated users with the Author role to access titles and edit links of private, draft, or otherwise restricted posts via the AJAX query-attachments endpoint. The wp_prepare_attachment_for_js() function did not verify that the current user has permission to read the parent post of an attachment before including the parent post’s title and edit link in the response.

This vulnerability affects the following application versions:

WordPress 5.6
WordPress 5.6.1
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.17
WordPress 6.0.18
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.9
WordPress 6.9.1

Null Character Entity Bypass in Numeric Character Reference Normalization

Skrevet den 20. marts 2026 af i WordPress

The regex patterns in wp_kses_normalize_entities() accept � and � (and their zero-padded variants like �, �) as valid numeric character references. These null byte entities pass through normalization and can be used to evade downstream sanitization filters. The fix tightens the regexes to require a non-zero leading digit, preventing null character entities from being recognized as valid.

This vulnerability affects the following application versions:

WordPress 3.5
WordPress 3.5.1
WordPress 3.5.2
WordPress 3.6
WordPress 3.6.1
WordPress 3.7
WordPress 3.7.1
WordPress 3.7.2
WordPress 3.7.3
WordPress 3.7.4
WordPress 3.7.5
WordPress 3.7.6
WordPress 3.7.7
WordPress 3.7.8
WordPress 3.7.9
WordPress 3.7.10
WordPress 3.7.11
WordPress 3.7.12
WordPress 3.7.13
WordPress 3.7.14
WordPress 3.7.15
WordPress 3.7.16
WordPress 3.7.17
WordPress 3.7.18
WordPress 3.7.19
WordPress 3.7.20
WordPress 3.7.21
WordPress 3.7.22
WordPress 3.7.23
WordPress 3.7.24
WordPress 3.7.25
WordPress 3.7.26
WordPress 3.7.27
WordPress 3.7.28
WordPress 3.7.29
WordPress 3.7.30
WordPress 3.7.31
WordPress 3.7.32
WordPress 3.7.33
WordPress 3.7.34
WordPress 3.7.35
WordPress 3.7.36
WordPress 3.7.37
WordPress 3.7.38
WordPress 3.7.39
WordPress 3.7.40
WordPress 3.7.41
WordPress 3.8
WordPress 3.8.1
WordPress 3.8.2
WordPress 3.8.3
WordPress 3.8.4
WordPress 3.8.5
WordPress 3.8.6
WordPress 3.8.7
WordPress 3.8.8
WordPress 3.8.9
WordPress 3.8.10
WordPress 3.8.11
WordPress 3.8.12
WordPress 3.8.13
WordPress 3.8.14
WordPress 3.8.15
WordPress 3.8.16
WordPress 3.8.17
WordPress 3.8.18
WordPress 3.8.19
WordPress 3.8.20
WordPress 3.8.21
WordPress 3.8.22
WordPress 3.8.23
WordPress 3.8.24
WordPress 3.8.25
WordPress 3.8.26
WordPress 3.8.27
WordPress 3.8.28
WordPress 3.8.29
WordPress 3.8.30
WordPress 3.8.31
WordPress 3.8.32
WordPress 3.8.33
WordPress 3.8.34
WordPress 3.8.35
WordPress 3.8.36
WordPress 3.8.37
WordPress 3.8.38
WordPress 3.8.39
WordPress 3.8.40
WordPress 3.8.41
WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.3
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.27
WordPress 4.9.28
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.2
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.2
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.9
WordPress 6.9.1

SSRF in WordPress ixr-client

Skrevet den 20. marts 202630. oktober 2026 af i WordPress

A server-side request forgery vulnerability in WordPress allows unauthenticated attackers to send crafted XML-RPC pingback requests that cause the server to make arbitrary HTTP requests to internal or external hosts. This can be exploited for internal network reconnaissance, port scanning, or accessing cloud metadata services.

This vulnerability affects the following application versions:

WordPress 3.9
WordPress 3.9.1
WordPress 3.9.2
WordPress 3.9.3
WordPress 3.9.4
WordPress 3.9.5
WordPress 3.9.6
WordPress 3.9.7
WordPress 3.9.8
WordPress 3.9.9
WordPress 3.9.10
WordPress 3.9.11
WordPress 3.9.12
WordPress 3.9.13
WordPress 3.9.14
WordPress 3.9.15
WordPress 3.9.16
WordPress 3.9.17
WordPress 3.9.18
WordPress 3.9.19
WordPress 3.9.20
WordPress 3.9.21
WordPress 3.9.22
WordPress 3.9.23
WordPress 3.9.24
WordPress 3.9.25
WordPress 3.9.26
WordPress 3.9.27
WordPress 3.9.28
WordPress 3.9.29
WordPress 3.9.30
WordPress 3.9.31
WordPress 3.9.32
WordPress 3.9.33
WordPress 3.9.34
WordPress 3.9.35
WordPress 3.9.36
WordPress 3.9.37
WordPress 3.9.39
WordPress 3.9.40
WordPress 4.0
WordPress 4.0.1
WordPress 4.0.2
WordPress 4.0.3
WordPress 4.0.4
WordPress 4.0.5
WordPress 4.0.6
WordPress 4.0.7
WordPress 4.0.8
WordPress 4.0.9
WordPress 4.0.10
WordPress 4.0.11
WordPress 4.0.12
WordPress 4.0.13
WordPress 4.0.14
WordPress 4.0.15
WordPress 4.0.16
WordPress 4.0.17
WordPress 4.0.18
WordPress 4.0.19
WordPress 4.0.20
WordPress 4.0.21
WordPress 4.0.22
WordPress 4.0.23
WordPress 4.0.24
WordPress 4.0.25
WordPress 4.0.26
WordPress 4.0.27
WordPress 4.0.28
WordPress 4.0.29
WordPress 4.0.30
WordPress 4.0.31
WordPress 4.0.32
WordPress 4.0.33
WordPress 4.0.34
WordPress 4.0.35
WordPress 4.0.36
WordPress 4.0.37
WordPress 4.0.38
WordPress 4.1
WordPress 4.1.1
WordPress 4.1.2
WordPress 4.1.3
WordPress 4.1.4
WordPress 4.1.5
WordPress 4.1.6
WordPress 4.1.7
WordPress 4.1.8
WordPress 4.1.9
WordPress 4.1.10
WordPress 4.1.11
WordPress 4.1.12
WordPress 4.1.13
WordPress 4.1.14
WordPress 4.1.15
WordPress 4.1.16
WordPress 4.1.17
WordPress 4.1.18
WordPress 4.1.19
WordPress 4.1.20
WordPress 4.1.21
WordPress 4.1.22
WordPress 4.1.23
WordPress 4.1.24
WordPress 4.1.25
WordPress 4.1.26
WordPress 4.1.27
WordPress 4.1.28
WordPress 4.1.29
WordPress 4.1.30
WordPress 4.1.31
WordPress 4.1.32
WordPress 4.1.33
WordPress 4.1.34
WordPress 4.1.35
WordPress 4.1.36
WordPress 4.1.37
WordPress 4.1.38
WordPress 4.1.39
WordPress 4.1.40
WordPress 4.1.41
WordPress 4.1.42
WordPress 4.2
WordPress 4.2.1
WordPress 4.2.2
WordPress 4.2.3
WordPress 4.2.4
WordPress 4.2.5
WordPress 4.2.6
WordPress 4.2.7
WordPress 4.2.8
WordPress 4.2.9
WordPress 4.2.10
WordPress 4.2.11
WordPress 4.2.12
WordPress 4.2.13
WordPress 4.2.14
WordPress 4.2.15
WordPress 4.2.16
WordPress 4.2.17
WordPress 4.2.18
WordPress 4.2.19
WordPress 4.2.20
WordPress 4.2.21
WordPress 4.2.22
WordPress 4.2.23
WordPress 4.2.24
WordPress 4.2.25
WordPress 4.2.26
WordPress 4.2.27
WordPress 4.2.28
WordPress 4.2.29
WordPress 4.2.30
WordPress 4.2.31
WordPress 4.2.32
WordPress 4.2.33
WordPress 4.2.34
WordPress 4.2.35
WordPress 4.2.36
WordPress 4.2.37
WordPress 4.2.38
WordPress 4.2.39
WordPress 4.3
WordPress 4.3.1
WordPress 4.3.2
WordPress 4.3.3
WordPress 4.3.4
WordPress 4.3.5
WordPress 4.3.6
WordPress 4.3.7
WordPress 4.3.8
WordPress 4.3.9
WordPress 4.3.10
WordPress 4.3.11
WordPress 4.3.12
WordPress 4.3.13
WordPress 4.3.14
WordPress 4.3.15
WordPress 4.3.16
WordPress 4.3.17
WordPress 4.3.18
WordPress 4.3.19
WordPress 4.3.20
WordPress 4.3.21
WordPress 4.3.22
WordPress 4.3.23
WordPress 4.3.24
WordPress 4.3.25
WordPress 4.3.26
WordPress 4.3.27
WordPress 4.3.28
WordPress 4.3.29
WordPress 4.3.30
WordPress 4.3.31
WordPress 4.3.32
WordPress 4.3.33
WordPress 4.3.34
WordPress 4.3.35
WordPress 4.4
WordPress 4.4.1
WordPress 4.4.2
WordPress 4.4.3
WordPress 4.4.4
WordPress 4.4.5
WordPress 4.4.6
WordPress 4.4.7
WordPress 4.4.8
WordPress 4.4.9
WordPress 4.4.10
WordPress 4.4.11
WordPress 4.4.12
WordPress 4.4.13
WordPress 4.4.14
WordPress 4.4.15
WordPress 4.4.16
WordPress 4.4.17
WordPress 4.4.18
WordPress 4.4.19
WordPress 4.4.20
WordPress 4.4.21
WordPress 4.4.22
WordPress 4.4.23
WordPress 4.4.24
WordPress 4.4.25
WordPress 4.4.26
WordPress 4.4.27
WordPress 4.4.28
WordPress 4.4.29
WordPress 4.4.30
WordPress 4.4.31
WordPress 4.4.32
WordPress 4.4.33
WordPress 4.4.34
WordPress 4.5
WordPress 4.5.1
WordPress 4.5.2
WordPress 4.5.3
WordPress 4.5.4
WordPress 4.5.5
WordPress 4.5.6
WordPress 4.5.7
WordPress 4.5.8
WordPress 4.5.9
WordPress 4.5.10
WordPress 4.5.11
WordPress 4.5.12
WordPress 4.5.13
WordPress 4.5.14
WordPress 4.5.15
WordPress 4.5.16
WordPress 4.5.17
WordPress 4.5.18
WordPress 4.5.19
WordPress 4.5.20
WordPress 4.5.21
WordPress 4.5.22
WordPress 4.5.23
WordPress 4.5.24
WordPress 4.5.25
WordPress 4.5.26
WordPress 4.5.27
WordPress 4.5.28
WordPress 4.5.29
WordPress 4.5.30
WordPress 4.5.31
WordPress 4.5.32
WordPress 4.5.33
WordPress 4.6
WordPress 4.6.1
WordPress 4.6.2
WordPress 4.6.3
WordPress 4.6.4
WordPress 4.6.5
WordPress 4.6.6
WordPress 4.6.7
WordPress 4.6.8
WordPress 4.6.9
WordPress 4.6.10
WordPress 4.6.11
WordPress 4.6.12
WordPress 4.6.13
WordPress 4.6.14
WordPress 4.6.15
WordPress 4.6.16
WordPress 4.6.17
WordPress 4.6.18
WordPress 4.6.19
WordPress 4.6.20
WordPress 4.6.21
WordPress 4.6.22
WordPress 4.6.23
WordPress 4.6.24
WordPress 4.6.25
WordPress 4.6.26
WordPress 4.6.27
WordPress 4.6.28
WordPress 4.6.29
WordPress 4.6.30
WordPress 4.7
WordPress 4.7.1
WordPress 4.7.2
WordPress 4.7.3
WordPress 4.7.4
WordPress 4.7.5
WordPress 4.7.6
WordPress 4.7.7
WordPress 4.7.8
WordPress 4.7.9
WordPress 4.7.10
WordPress 4.7.11
WordPress 4.7.12
WordPress 4.7.13
WordPress 4.7.14
WordPress 4.7.15
WordPress 4.7.16
WordPress 4.7.17
WordPress 4.7.18
WordPress 4.7.19
WordPress 4.7.20
WordPress 4.7.21
WordPress 4.7.22
WordPress 4.7.23
WordPress 4.7.24
WordPress 4.7.25
WordPress 4.7.26
WordPress 4.7.27
WordPress 4.7.28
WordPress 4.7.29
WordPress 4.7.30
WordPress 4.7.31
WordPress 4.8
WordPress 4.8.1
WordPress 4.8.10
WordPress 4.8.11
WordPress 4.8.12
WordPress 4.8.13
WordPress 4.8.2
WordPress 4.8.3
WordPress 4.8.4
WordPress 4.8.5
WordPress 4.8.6
WordPress 4.8.7
WordPress 4.8.8
WordPress 4.8.9
WordPress 4.8.14
WordPress 4.8.15
WordPress 4.8.16
WordPress 4.8.17
WordPress 4.8.18
WordPress 4.8.19
WordPress 4.8.20
WordPress 4.8.21
WordPress 4.8.22
WordPress 4.8.23
WordPress 4.8.24
WordPress 4.8.25
WordPress 4.8.26
WordPress 4.8.27
WordPress 4.9
WordPress 4.9.1
WordPress 4.9.2
WordPress 4.9.10
WordPress 4.9.11
WordPress 4.9.12
WordPress 4.9.13
WordPress 4.9.14
WordPress 4.9.15
WordPress 4.9.16
WordPress 4.9.17
WordPress 4.9.18
WordPress 4.9.19
WordPress 4.9.20
WordPress 4.9.21
WordPress 4.9.22
WordPress 4.9.23
WordPress 4.9.24
WordPress 4.9.25
WordPress 4.9.26
WordPress 4.9.3
WordPress 4.9.4
WordPress 4.9.5
WordPress 4.9.6
WordPress 4.9.7
WordPress 4.9.8
WordPress 4.9.9
WordPress 4.9.27
WordPress 4.9.28
WordPress 5.0
WordPress 5.0.1
WordPress 5.0.2
WordPress 5.0.3
WordPress 5.0.4
WordPress 5.0.6
WordPress 5.0.7
WordPress 5.0.8
WordPress 5.0.9
WordPress 5.0.10
WordPress 5.0.11
WordPress 5.0.12
WordPress 5.0.13
WordPress 5.0.14
WordPress 5.0.15
WordPress 5.0.16
WordPress 5.0.17
WordPress 5.0.18
WordPress 5.0.19
WordPress 5.0.20
WordPress 5.0.21
WordPress 5.0.22
WordPress 5.0.23
WordPress 5.0.24
WordPress 5.0 Beta 1
WordPress 5.0 Beta 2
WordPress 5.0 Beta 3
WordPress 5.0 Beta 4
WordPress 5.0 RC1
WordPress 5.0 RC2
WordPress 5.0 RC3
WordPress 5.1
WordPress 5.1.1
WordPress 5.1.10
WordPress 5.1.11
WordPress 5.1.12
WordPress 5.1.13
WordPress 5.1.14
WordPress 5.1.15
WordPress 5.1.16
WordPress 5.1.17
WordPress 5.1.18
WordPress 5.1.19
WordPress 5.1.2
WordPress 5.1.20
WordPress 5.1.21
WordPress 5.1.3
WordPress 5.1.4
WordPress 5.1.5
WordPress 5.1.6
WordPress 5.1.7
WordPress 5.1.8
WordPress 5.1.9
WordPress 5.2
WordPress 5.2.1
WordPress 5.2.10
WordPress 5.2.11
WordPress 5.2.12
WordPress 5.2.13
WordPress 5.2.14
WordPress 5.2.15
WordPress 5.2.16
WordPress 5.2.17
WordPress 5.2.18
WordPress 5.2.19
WordPress 5.2.2
WordPress 5.2.20
WordPress 5.2.21
WordPress 5.2.22
WordPress 5.2.23
WordPress 5.2.3
WordPress 5.2.4
WordPress 5.2.5
WordPress 5.2.6
WordPress 5.2.7
WordPress 5.2.8
WordPress 5.2.9
WordPress 5.2 Beta 1
WordPress 5.2 Beta 2
WordPress 5.3
WordPress 5.3.1
WordPress 5.3.10
WordPress 5.3.11
WordPress 5.3.12
WordPress 5.3.13
WordPress 5.3.14
WordPress 5.3.15
WordPress 5.3.16
WordPress 5.3.17
WordPress 5.3.18
WordPress 5.3.19
WordPress 5.3.2
WordPress 5.3.20
WordPress 5.3.3
WordPress 5.3.4
WordPress 5.3.5
WordPress 5.3.6
WordPress 5.3.7
WordPress 5.3.8
WordPress 5.3.9
WordPress 5.4
WordPress 5.4.1
WordPress 5.4.10
WordPress 5.4.11
WordPress 5.4.12
WordPress 5.4.13
WordPress 5.4.14
WordPress 5.4.15
WordPress 5.4.16
WordPress 5.4.17
WordPress 5.4.18
WordPress 5.4.2
WordPress 5.4.3
WordPress 5.4.4
WordPress 5.4.5
WordPress 5.4.6
WordPress 5.4.7
WordPress 5.4.8
WordPress 5.4.9
WordPress 5.5
WordPress 5.5.1
WordPress 5.5.10
WordPress 5.5.11
WordPress 5.5.12
WordPress 5.5.13
WordPress 5.5.14
WordPress 5.5.15
WordPress 5.5.16
WordPress 5.5.17
WordPress 5.5.2
WordPress 5.5.3
WordPress 5.5.4
WordPress 5.5.5
WordPress 5.5.6
WordPress 5.5.7
WordPress 5.5.8
WordPress 5.5.9
WordPress 5.6
WordPress 5.6.1
WordPress 5.6.10
WordPress 5.6.11
WordPress 5.6.12
WordPress 5.6.13
WordPress 5.6.14
WordPress 5.6.15
WordPress 5.6.16
WordPress 5.6.2
WordPress 5.6.3
WordPress 5.6.4
WordPress 5.6.5
WordPress 5.6.6
WordPress 5.6.7
WordPress 5.6.8
WordPress 5.6.9
WordPress 5.7
WordPress 5.7.1
WordPress 5.7.10
WordPress 5.7.11
WordPress 5.7.12
WordPress 5.7.13
WordPress 5.7.14
WordPress 5.7.2
WordPress 5.7.3
WordPress 5.7.4
WordPress 5.7.5
WordPress 5.7.6
WordPress 5.7.7
WordPress 5.7.8
WordPress 5.7.9
WordPress 5.8
WordPress 5.8.1
WordPress 5.8.10
WordPress 5.8.11
WordPress 5.8.12
WordPress 5.8.2
WordPress 5.8.3
WordPress 5.8.4
WordPress 5.8.5
WordPress 5.8.6
WordPress 5.8.7
WordPress 5.8.8
WordPress 5.8.9
WordPress 5.9
WordPress 5.9.1
WordPress 5.9.10
WordPress 5.9.11
WordPress 5.9.12
WordPress 5.9.2
WordPress 5.9.3
WordPress 5.9.4
WordPress 5.9.5
WordPress 5.9.6
WordPress 5.9.7
WordPress 5.9.8
WordPress 5.9.9
WordPress 6.0
WordPress 6.0.1
WordPress 6.0.10
WordPress 6.0.11
WordPress 6.0.12
WordPress 6.0.13
WordPress 6.0.14
WordPress 6.0.15
WordPress 6.0.16
WordPress 6.0.17
WordPress 6.0.18
WordPress 6.0.2
WordPress 6.0.3
WordPress 6.0.4
WordPress 6.0.5
WordPress 6.0.6
WordPress 6.0.7
WordPress 6.0.8
WordPress 6.0.9
WordPress 6.1
WordPress 6.1.1
WordPress 6.1.2
WordPress 6.1.3
WordPress 6.1.4
WordPress 6.1.5
WordPress 6.1.6
WordPress 6.1.7
WordPress 6.1.8
WordPress 6.1.9
WordPress 6.2
WordPress 6.2.1
WordPress 6.2.2
WordPress 6.2.3
WordPress 6.2.4
WordPress 6.2.5
WordPress 6.2.6
WordPress 6.2.7
WordPress 6.2.8
WordPress 6.3
WordPress 6.3.1
WordPress 6.3.2
WordPress 6.3.3
WordPress 6.3.4
WordPress 6.3.5
WordPress 6.3.6
WordPress 6.3.7
WordPress 6.4
WordPress 6.4.1
WordPress 6.4.2
WordPress 6.4.3
WordPress 6.4.4
WordPress 6.4.5
WordPress 6.4.6
WordPress 6.4.7
WordPress 6.5
WordPress 6.5.2
WordPress 6.5.3
WordPress 6.5.4
WordPress 6.5.5
WordPress 6.5.6
WordPress 6.5.7
WordPress 6.6
WordPress 6.6.1
WordPress 6.6.2
WordPress 6.6.3
WordPress 6.6.4
WordPress 6.7
WordPress 6.7.1
WordPress 6.7.2
WordPress 6.7.3
WordPress 6.7.4
WordPress 6.8
WordPress 6.8.1
WordPress 6.8.2
WordPress 6.8.3
WordPress 6.9
WordPress 6.9.1

Stored XSS via the data-wp-bind directive in block patterns

Skrevet den 20. marts 202630. oktober 2026 af i WordPress

WordPress is vulnerable to stored XSS via the data-wp-bind directive due to insufficient validation in block pattern file inclusion and template element lookups. The fix hardens the block pattern registry with path validation and restricts wp.template to match only