Skip to content
BackEsc
Connect AISign inSign up free

WordPress · weakness class

Cross-site Scripting

115 CVEs · 1 exploited

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Connect AI

exploited in the wild
1
check available
5
likely to be exploited
2

Every one of the 115 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. WordPress Social Warfare <3.5.3 - Cross-Site ScriptingCVE-2019-9978WordPress · CVSS 6.1 · 73% likely

    CWE-79

  2. WordPress Core <6.5.2 - Cross-Site ScriptingCVE-2024-4439WordPress Foundation · CVSS 7.2 · 71% likely

    CWE-79

  3. Alert Before Your Post <= 0.1.1 - Cross-Site ScriptingCVE-2011-5107Wordpress · 8.8% likely

    CWE-79

  4. WordPress Sniplets <=1.2.2 - Cross-Site ScriptingCVE-2008-1061Wordpress · 7.4% likely

    CWE-79

  5. WordPress < 4.9.1 - Authenticated JavaScript File UploadCVE-2017-17092Wordpress · 3.5% likely

    CWE-79

  6. WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)CVE-2026-64638WordPress · CVSS 8.9 · 0.9% likelycovered by CyberSIXT

    CWE-79

  7. Stored XSS in WordPressCVE-2022-21662WordPress · CVSS 8 · 65% likely

    CWE-79

  8. Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that…CVE-2015-3440Wordpress · 17% likely

    CWE-79

  9. Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via a comment auth…CVE-2009-2851Wordpress · 7.9% likely

    CWE-79

  10. Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 4.1.2, when MySQL is used without strict mode, allow remote attackers to inject arbitrary web script or HTM…CVE-2015-3438Wordpress · 7.4% likely

    CWE-79

  11. Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbit…CVE-2016-4567Wordpress · 7.4% likely

    CWE-79

  12. Cross-site scripting (XSS) vulnerability in the form function in the WP_Nav_Menu_Widget class in wp-includes/default-widgets.php in WordPress before 4.2.4 allows remote attackers…CVE-2015-5732Wordpress · 7.0% likely

    CWE-79

  13. Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inject arbitrary web script or HTML via the posts_columns array…CVE-2007-5710Wordpress · 7.0% likely

    CWE-79

  14. Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web script or HTML by leveraging the mishandling of unclosed HTML el…CVE-2015-5714Wordpress · 6.9% likely

    CWE-79

  15. Cross-site scripting (XSS) vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary…CVE-2015-5734Wordpress · 6.5% likely

    CWE-79

  16. Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script…CVE-2016-4566Wordpress · 6.0% likely

    CWE-79

  17. WordPress before 5.2.3 allows XSS in post previews by authenticated users.CVE-2019-16223Wordpress · 5.2% likely

    CWE-79

  18. Cross-site scripting (XSS) vulnerability in the wptexturize function in WordPress before 3.7.5, 3.8.x before 3.8.5, and 3.9.x before 3.9.3 allows remote attackers to inject arbitr…CVE-2014-9031Wordpress · 5.2% likely

    CWE-79

  19. Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and…CVE-2015-3439Wordpress · 5.1% likely

    CWE-79

  20. Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the popuptitle parameter to (1…CVE-2008-0192Wordpress · 5.1% likely

    CWE-79

  21. Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) inviteemail parameter in an invite…CVE-2008-1304Wordpress · 5.0% likely

    CWE-79

  22. Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject…CVE-2015-5733Wordpress · 5.0% likely

    CWE-79

  23. Cross-site scripting (XSS) vulnerability in WordPress before 4.2.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the Author or Contributor…CVE-2015-5622Wordpress · 4.9% likely

    CWE-791 bounty report

  24. Cross-site scripting (XSS) vulnerability in the choose_primary_blog function in wp-includes/wpmu-functions.php in WordPress MU (WPMU) before 2.7 allows remote attackers to inject…CVE-2009-1030Wordpress · 4.7% likely

    CWE-79

  25. Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 and 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the user_email parameter.CVE-2007-5105Wordpress · 4.4% likely

    CWE-79

  26. Before WordPress 4.9.5, the version string was not escaped in the get_the_generator function, and could lead to XSS in a generator tag.CVE-2018-10102Wordpress · 4.3% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Sign inSign up free

Updated