Wordpress unzip_file path traversal Analysed #205481 Valid Misconfiguration and Insecure Design Medium 2020-01-29 – 119 Pivilege escalation of any new user to Keymaster caused by CSRF Analysed #2999394 Valid Access Control Medium 2025-09-13 – 61 Unauthenticated disclosure of draft/private/pending post titles & IDs via Secure Custom Fields nopriv AJAX field-query handlers (post_object/relations Analysed #3893632 Valid Access Control Medium 2026-09-28 – 51 wp-embed XSS on Safari Analysed #1238528 Valid Cross-site Scripting Medium 2023-07-01 – 49 Authenticated XXE Analysed #1095645 Valid Injection and Smuggling Medium 2021-05-18 – 41 CampTix [camptix_private]: the view token is derived from the requester's own IP, so naming any attendee's e-mail unlocks the gated content Analysed #4043537 Valid Authentication Medium 2026-10-30 – 36 "Bad Protocols Validation" Bypass in "wp_kses_bad_protocol_once" using HTML-encoding without trailing semicolons Analysed #339483 Valid Cross-site Scripting Medium 2019-11-16 – 34 Information / sensitive data disclosure on some endpoints Analysed #273726 Valid Information Disclosure Medium 2018-08-22 – 32 wordpress.org/openverse/: unauthenticated open redirect — `str_replace()`'s 4th arg is a count, not a limit; bypasses WordPress.org SSO allow-list Analysed #3933198 Valid Open Redirect Medium 2026-10-30 – 31 [mercantile.wordpress.org] Reflected XSS via AngularJS Template Injection Analysed #230234 Valid Cross-site Scripting Medium 2017-06-14 – 29 Information Disclosure - Unauthen Leak Private Content Analysed #4053546 Valid Information Disclosure Medium 2026-10-10 – 27 Authenticated Stored Cross-site Scripting in bbPress #881918 Valid Cross-site Scripting Medium 2020-06-29 – 24 WordCamp Meta gpre: password-protected event RSVP list readable without password via /gpre/v1/.../rsvp-responses #4029867 Valid Access Control Medium 2026-11-05 – 23 XSS via unicode characters in upload filename #179695 Valid Cross-site Scripting Medium 2020-08-28 – 23 Arbitrary change of blog's background image via CSRF #881855 Valid Cross-Site Request Forgery Medium 2020-12-14 – 21 Reflected Swf XSS In ( plugins.svn.wordpress.org ) #270060 Valid No weakness recorded Medium 2018-09-27 – 21 DOM Based XSS In mercantile.wordpress.org #230435 Valid Cross-site Scripting Medium 2017-06-14 – 21 Infrastructure - Photon - SSRF #204513 Valid Server-Side Request Forgery Medium 2017-07-17 – 21 Large-site Quick Edit reparses a Contributor display name into active HTML #3878399 Valid Cross-site Scripting Medium 2026-10-21 – 20 [FG-VD-18-165] Wordpress Cross-Site Scripting Vulnerability Notification II #460911 Valid Cross-site Scripting Medium 2019-10-11 – 20 XSS in the search bar of mercantile.wordpress.org #221893 Valid Cross-site Scripting Medium 2017-05-20 – 19 PII of users can be downloaded from export pages #1172852 Valid Information Disclosure Medium 2023-05-12 – 17 Reflected XSS at https://da.wordpress.org/themes/?s= via "s=" parameter #222040 Valid Cross-site Scripting Medium 2017-07-26 – 16 Reflected XSS: Taxonomy Converter via tax parameter #495515 Valid Cross-site Scripting Medium 2019-08-28 – 15 Authenticated Cross-site Scripting in Template Name #220903 Valid Cross-site Scripting Medium 2017-11-18 – 15 Stored XSS in Post Preview as Contributor #497724 Valid Cross-site Scripting Medium 2020-08-18 – 14 Buddypress 2.9.1 - Exceeding the maximum upload size - XSS leading to potential RCE. #263109 Valid No weakness recorded Medium 2017-11-02 – 14 [mercantile.wordpress.org] Reflected XSS #240256 Valid Cross-site Scripting Medium 2018-08-30 – 13 Improper Access Control in Buddypress core allows reply,delete any user's activity #837256 Valid Access Control Medium 2020-05-22 – 12 Lack of Sanitization and Insufficient Authentication #249759 Valid Cross-site Scripting Medium 2017-12-26 – 11 code.wordpress.net subdomain Takeover #295330 Valid No weakness recorded Medium 2018-03-11 – 9 Allow authenticated users can edit, trash,and add new in BuddyPress Emails function #833782 Valid Access Control Medium 2020-05-22 – 8 Privilege Escalation in BuddyPress core allows Moderate to Administrator #837018 Valid No weakness recorded Medium 2020-05-22 – 6 Unauthenticated hidden groups disclosure via Ajax groups search #282176 Valid Access Control Medium 2017-11-02 – 6 CSRF in Profile Fields allows deleting any field in BuddyPress #836187 Valid Cross-Site Request Forgery Medium 2020-05-22 – 5