WordPress 2.9.2

WordPress 2.9.2 has 240 disclosed vulnerabilities in the WordSec catalog, reported between 2007 and 2025; all 240 are fixed as of August 2026. Their average CVSS score is 6.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 6 critical and 51 high. 2017 was the busiest year with 40 disclosures.

The most common weakness is Cross-Site Scripting, behind 96 of the records (40%). Other recurring categories include Improper Authorization, Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 240 issues recorded for WordPress 2.9.2 has a vendor fix available, so running the current release closes all known holes.

116 independent researchers contributed these findings, most of them (8) reported by Ben Bidner.

01234567891011.02.2007Today11.02.20076.4WordPress Core <= 3.0.4 - Cross-Site Scripting CVSS 6.4 · 11.02.200729.07.20104.7WordPress Core < 3.0.1 - Missing Authorization CVSS 4.7 · 29.07.201030.11.20105.3WordPress Core < 3.0.2 - Spam Protection Bypass CVSS 5.3 · 30.11.20108.8WordPress Core <= 3.0.1 - SQL Injection CVSS 8.8 · 30.11.20106.4WordPress Core < 3.0.2 - Cross-Site Scripting CVSS 6.4 · 30.11.20106.4WordPress Core < 3.0.2 - Cross-Site Scripting CVSS 6.4 · 30.11.201008.12.20106.3WordPress Core < 3.0.3 - Access Control Bypass CVSS 6.3 · 08.12.201029.12.20106.4WordPress Core <= 3.0.3 - Cross-Site Scripting CVSS 6.4 · 29.12.201030.12.20105.4WordPress Core < 3.0.2 - Missing Authorization CVSS 5.4 · 30.12.201028.01.20117.5WordPress Core 2.9.2 and 3.0.4 - Sensitive Information Disclosure CVSS 7.5 · 28.01.201107.02.20114.3WordPress Core < 3.0.5 - Improper Authorization to Information Disclosure CVSS 4.3 · 07.02.201105.04.20116.4WordPress Core <= 3.1 - Cross-Site Scripting CVSS 6.4 · 05.04.20117.5WordPress Core < 3.1.1 - Denial of Service CVSS 7.5 · 05.04.201126.04.20114.3WordPress Core < 3.1.2 - Incorrect Authorization for Contributor-level users CVSS 4.3 · 26.04.20116.3WordPress Core < 3.0.6 - Incorrect Authorization Checks CVSS 6.3 · 26.04.201125.05.20116.3WordPress Core < 3.1.3 - Media Related Security Issue CVSS 6.3 · 25.05.20117.1WordPress Core < 3.1.3 - Clickjacking CVSS 7.1 · 25.05.20114.3WordPress Core < 3.1.3 - Sensitive Information Disclosure CVSS 4.3 · 25.05.20115.3WordPress Core < 3.1.3 - Username Enumeration CVSS 5.3 · 25.05.20116.3WordPress Core < 3.1.3 - Security Hardening CVSS 6.3 · 25.05.20118.8WordPress Core <= 3.1.2 - SQL Injection CVSS 8.8 · 25.05.20118.8WordPress Core <= 3.1.2 - Arbitrary File Upload CVSS 8.8 · 25.05.201103.01.20126.4WordPress Core <= 3.3 - Cross-Site Scripting CVSS 6.4 · 03.01.201220.04.20126.4WordPress Core < 3.3.2 - Cross-Site Scripting CVSS 6.4 · 20.04.20125.4WordPress Core < 3.3.2 - Authorization Bypass CVSS 5.4 · 20.04.20126.5WordPress Core <= 3.3.1 - Same Origin Policy Bypass CVSS 6.5 · 20.04.20127.2WordPress Core < 3.3.2 - Cross-Site Scripting CVSS 7.2 · 20.04.20125.4WordPress Core <= 3.3.1 - Cross-Site Scripting CVSS 5.4 · 20.04.201221.04.20127.2WordPress Core <= 3.5.1 - Cross-Site Scripting CVSS 7.2 · 21.04.20125.4WordPress Core <= 3.3.1 - Cross-Site Scripting CVSS 5.4 · 21.04.201220.06.20123.7WordPress Core - Informational < 6.8 - Weak Hashing Algorithm CVSS 3.7 · 20.06.201227.06.20125.3WordPress Core <= 3.3.2 - Sensitive Information Disclosure CVSS 5.3 · 27.06.20124.3WordPress Core <= 3.3.2 - Sensitive Information Disclosure CVSS 4.3 · 27.06.20124.3WordPress Core < 3.4.1 - Information Disclosure CVSS 4.3 · 27.06.20126.5WordPress Core <= 3.3.2 - Cross-Site Scripting CVSS 6.5 · 27.06.20128.8WordPress Core < 3.4.1 - Cross-Site Request Forgery CVSS 8.8 · 27.06.201206.09.20126.4WordPress Core < 3.4.2 - Cross-Site Scripting CVSS 6.4 · 06.09.20126.3WordPress Core < 3.4.2 - Missing Authorization Checks on create_post CVSS 6.3 · 06.09.20123.8WordPress Core < 3.4.2 - Missing Authorization Checks CVSS 3.8 · 06.09.201209.11.20126.1SWFUpload <= 2.2.0.1 - Cross-Site Scripting CVSS 6.1 · 09.11.201227.12.20125.4WordPress Core < 4.0 - Missing Session Cookie Expiration CVSS 5.4 · 27.12.201224.01.20136.4WordPress Core < 3.5.1 - Cross-Site Scripting CVSS 6.4 · 24.01.20135.4WordPress Core < 3.5.1 - Server-Side Request Forgery CVSS 5.4 · 24.01.20136.4WordPress Core < 3.5.1 - Stored Cross-Site Scripting CVSS 6.4 · 24.01.201321.06.20136.4WordPress Core < 3.5.2 - Cross-Site Scripting via Multiple Vectors CVSS 6.4 · 21.06.20135.4WordPress Core < 3.5.2 - Server Side Request Forgery CVSS 5.4 · 21.06.20134.6WordPress Core <= 3.5.1 - Content-Spoofing Attacks CVSS 4.6 · 21.06.20135.4WordPress Core < 3.5.2 - XXE Injection CVSS 5.4 · 21.06.20136.3WordPress Core < 3.5.2 - Missing Authorization Checks CVSS 6.3 · 21.06.20136.4WordPress Core < 3.5.2 - Cross-Site Scripting CVSS 6.4 · 21.06.20135.3WordPress Core <= 3.5.1 - Denial of Service via wp-postpass cookie CVSS 5.3 · 21.06.20134.3WordPress Core < 3.5.2 - Sensitive Information Disclosure CVSS 4.3 · 21.06.201311.09.20136.4WordPress Core < 3.6.1 - HTML File Upload CVSS 6.4 · 11.09.20135.4WordPress Core < 3.6.1 - Open Redirect CVSS 5.4 · 11.09.20138.8WordPress Core < 3.6.1 - Deserialization CVSS 8.8 · 11.09.20136.4WordPress Core < 3.6.1 - .swf and .exe File Upload CVSS 6.4 · 11.09.20136.3WordPress Core < 3.6.1 - Spoof Post Authorship CVSS 6.3 · 11.09.201308.04.20144.3WordPress Core < 3.8.2 - Contributor Users Can Publish Posts CVSS 4.3 · 08.04.20146.5WordPress Core < 3.8.2 - Authentication Cookie Forgery CVSS 6.5 · 08.04.201406.08.20145.3WordPress Core <= 3.9.1 - XML External Entity (XXE) Weakness CVSS 5.3 · 06.08.20146.5WordPress Core < 3.9.2 - Brute Force of Cross-Site Request Forgery Tokens CVSS 6.5 · 06.08.20148.8WordPress Core < 4.0.1 - Cross-Site Request Forgery to Authentication Takeover CVSS 8.8 · 06.08.20146.5WordPress Core < 3.9.2 - Denial of Service via XML #2 CVSS 6.5 · 06.08.20147.2WordPress Core < 3.9.2 - Deserialization via Widgets CVSS 7.2 · 06.08.20143.8WordPress Core < 3.9.2 - Authenticated Cross-Site Scripting via Avatar URL CVSS 3.8 · 06.08.20148.8WordPress Core < 3.9.2 - Cross-Site Request Forgery Protection Bypass CVSS 8.8 · 06.08.20142.7WordPress Core < 3.9.2 - Denial of Service via XML CVSS 2.7 · 06.08.201420.11.20146.4WordPress Core < 4.0.1 - Cross-Site Scripting CVSS 6.4 · 20.11.20146.4WordPress Core < 4.0.1 - Cross-Site Scripting via Shortcode Brackets CVSS 6.4 · 20.11.20148.8WordPress Core < 4.0.1 Cross-Site Request Forgery to Password Reset CVSS 8.8 · 20.11.20145.3WordPress Core < 4.0.1 - Denial of Service via Long Password CVSS 5.3 · 20.11.20147.2WordPress Core < 4.0.1 - Cross-Site Scripting via media-playlists CVSS 7.2 · 20.11.20146.4WordPress Core < 4.0.1 - Cross-Site Scripting via CSS CVSS 6.4 · 20.11.20148.1Wordpress Core < 4.0.1 - Hash Collision CVSS 8.1 · 20.11.20147.7WordPress Core < 4.0.1 - Server-Side Request Forgery CVSS 7.7 · 20.11.201412.02.20157.5WordPress Core < 4.4 - Brute Force Password Recovery Tokens CVSS 7.5 · 12.02.201508.04.20156.4Twenty Fifteen Theme <= 1.1 & WordPress Core < 4.2.2 - Cross-Site Scripting via example.html CVSS 6.4 · 08.04.201520.04.20155.4WordPress Core < 4.1.2 - Cross-Site Scripting via Ephox in Plupload CVSS 5.4 · 20.04.201521.04.20157.2WordPress Core < 4.1.2 - Cross-Site Scripting CVSS 7.2 · 21.04.201507.05.20157.2WordPress Core < 4.2.2 - Cross-Site Scripting via Comments CVSS 7.2 · 07.05.201523.07.20156.5WordPress Core < 4.2.3 - Authorization Bypass CVSS 6.5 · 23.07.20156.4WordPress Core < 4.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 23.07.201504.08.20155.4WordPress Core < 4.2.4 - Stored Cross-Site Scripting via accessibility-helper Title CVSS 5.4 · 04.08.20158.8WordPress Core < 4.2.4 - SQL Injection CVSS 8.8 · 04.08.20156.1WordPress Core < 4.2.4 - Cross-Site Scripting in Theme Preview CVSS 6.1 · 04.08.20159.6WordPress Core < 4.2.4 - Cross-Site Request Forgery to Post Lockage CVSS 9.6 · 04.08.20155.3WordPress Core < 4.2.4 - Timing Side-Channel Attack CVSS 5.3 · 04.08.20155.5WordPress Core < 4.2.4 - Cross-Site Scripting via Widget Title CVSS 5.5 · 04.08.201515.09.20156.4WordPress Core < 4.3.1 - Authenticated Cross-Site Scripting CVSS 6.4 · 15.09.20156.4WordPress Core < 4.3.1 - Cross-Site Scripting via Shortcodes CVSS 6.4 · 15.09.20155.4WordPress Core < 4.3.1 - Authorization Bypass to Information Disclosure CVSS 5.4 · 15.09.201516.01.20165.5WordPress Core < 4.4.1 - Cross-Site Scripting via Theme Names CVSS 5.5 · 16.01.201602.02.20166.4WordPress Core < 4.4.2 - Server-Side Request Forgery CVSS 6.4 · 02.02.20165.4WordPress Core < 4.4.2 - Open Redirect via wp_validate_redirect CVSS 5.4 · 02.02.201612.03.20168.8WordPress Core < 4.5 - Cross-Site Request Forgery via wp_ajax_wp_compression_test CVSS 8.8 · 12.03.201612.04.20166.4WordPress Core < 4.5 - Cross-Site Scripting via Network Settings Page CVSS 6.4 · 12.04.201606.05.20166.4WordPress Core < 4.5.2 - Cross-Site Scripting via MediaElement.js CVSS 6.4 · 06.05.20166.1WordPress Core < 4.5.2 - Cross-Site Scripting via plupload.flash.swf CVSS 6.1 · 06.05.201618.06.20165.4WordPress Core < 4.5.3 - Authorization Bypass to Remove Category Attribute CVSS 5.4 · 18.06.20165.3WordPress Core < 4.5.3 - Password Change via Stolen Cookie CVSS 5.3 · 18.06.20167.3WordPress Core < 4.5.3 - Bypass sanitize_file_name Protection CVSS 7.3 · 18.06.20166.4WordPress Core < 4.5.3 - Cross-Site Scripting via Attachment Name CVSS 6.4 · 18.06.20165.5WordPress Core < 4.5.3 - Cross-Site Scripting via Customizer CVSS 5.5 · 18.06.20165.3WordPress Core < 4.5.3 - Denial of Service via oEmbed Protocol CVSS 5.3 · 18.06.20164.3WordPress Core < 4.5.3 - Revision History Disclosure CVSS 4.3 · 18.06.20166.4WordPress Core < 4.5.3 - Cross-Site Scripting via Attachment Name #2 CVSS 6.4 · 18.06.201616.08.20164.3WordPress Core < 4.6 - Authorization Bypass CVSS 4.3 · 16.08.20168.8WordPress Core < 4.6 - Cross-Site Request Forgery CVSS 8.8 · 16.08.201622.08.20166.5WordPress Core <= 4.5.3 - Denial of Service CVSS 6.5 · 22.08.201607.09.20164.8WordPress Core < 4.6.1 - Authenticated Stored Cross-Site Scripting CVSS 4.8 · 07.09.20166.5WordPress Core < 4.6.1 - Authenticated Directory Traversal to Arbitrary File Access CVSS 6.5 · 07.09.201629.09.20165.0WordPress Core < 4.5 - Server-Side Request Forgery CVSS 5.0 · 29.09.201601.01.20174.3WordPress Core < 4.7.2 - Path Disclosure CVSS 4.3 · 01.01.201711.01.20174.3WordPress Core < 4.7.1 - Information Disclosure CVSS 4.3 · 11.01.20175.3WordPress Core < 4.7.1 - Weak Multi-Site Activation Key for User and Site Signup CVSS 5.3 · 11.01.20178.8WordPress Core < 4.7.1 - Cross-Site Request Forgery via Widget Editing CVSS 8.8 · 11.01.20175.5WordPress Core < 4.7.1 - Cross-Site Scripting via Name and Version Header of Plugin CVSS 5.5 · 11.01.20178.3WordPress Core < 4.7.1 - Authorization Bypass CVSS 8.3 · 11.01.20178.8WordPress Core < 4.7.1 - Cross-Site Request Forgery via Uploading Flash File CVSS 8.8 · 11.01.20175.5WordPress Core < 4.7.1 - Stored Cross-Site Scripting via theme directory name CVSS 5.5 · 11.01.201726.01.20174.3WordPress Core < 4.7.2 - Authorization Bypass to Term Disclosure CVSS 4.3 · 26.01.20178.8WordPress Core < 4.7.2 - Authenticated SQL Injection CVSS 8.8 · 26.01.20176.1WordPress Core < 4.7.2 - Cross-Site Scripting CVSS 6.1 · 26.01.20177.3WordPress Core < 4.7.2 - Arbitrary Page Modification CVSS 7.3 · 26.01.201706.03.20176.4WordPress Core < 4.7.3 - Authenticated Cross-Site Scripting in Youtube URL Embeds CVSS 6.4 · 06.03.20176.1WordPress Core < 4.7.3 - Bypass URL Validation CVSS 6.1 · 06.03.20178.8WordPress Core < 4.7.3 - Cross-Site Request Forgery via Press This CVSS 8.8 · 06.03.20176.4WordPress Core < 4.7.3 - Cross-Site Scripting via Media Metadata CVSS 6.4 · 06.03.20176.4WordPress Core < 4.7.3 - Cross-Site Scripting via Taxonomy names CVSS 6.4 · 06.03.20174.9WordPress Core < 4.7.3 - Arbitrary File Deletion CVSS 4.9 · 06.03.201703.05.20175.9Wordpress Core < 5.5 - Unauthorized Password Reset via Interception CVSS 5.9 · 03.05.201716.05.20175.4WordPress Core < 4.7.5 - Authorization Bypass Allowing Post Meta Updates CVSS 5.4 · 16.05.20176.3WordPress Core < 4.7.5 - Mishandling Post Meta Values via XML-RPC CVSS 6.3 · 16.05.20177.7WordPress Core < 4.7.5 - Server-Side Request Forgery CVSS 7.7 · 16.05.20175.5WordPress Core < 4.7.5 - Cross-Site Scripting via Customizer CVSS 5.5 · 16.05.20176.4WordPress Core < 4.7.5 - Stored Cross-Site Scripting via filenames CVSS 6.4 · 16.05.20178.8WordPress Core < 4.7.5 - Cross-Site Request Forgery Filesystem Credential Update CVSS 8.8 · 16.05.201719.09.20173.5WordPress Core < 4.8.2 - Open Redirect in Admin Dashboard CVSS 3.5 · 19.09.20179.8WordPress Core < 4.8.2 - SQL Injection via Mishandled Placeholders CVSS 9.8 · 19.09.20176.4WordPress Core < 4.8.2 - Cross-Site Scripting in oEmbed CVSS 6.4 · 19.09.20176.4WordPress Core < 4.8.2 - Cross-Site Scripting via Template Name CVSS 6.4 · 19.09.20174.9WordPress Core < 4.8.2 - Directory Traversal via Customizer CVSS 4.9 · 19.09.20176.4WordPress Core < 4.8.2 - Cross-Site Scripting via Javascript: and Data: URLs CVSS 6.4 · 19.09.20175.5WordPress Core < 4.8.2 - Stored Cross-Site Scripting via Plugin Names CVSS 5.5 · 19.09.20174.3WordPress Core < 4.8.2 - Directory Traversal during unzip CVSS 4.3 · 19.09.20176.4WordPress Core < 4.8.2 - Cross-Site Scripting via Shortcodes CVSS 6.4 · 19.09.201710.10.20174.7WordPress Core < 4.9.1 - Cross-domain Flash injection CVSS 4.7 · 10.10.201731.10.20179.8WordPress Core < 4.8.3 - SQL Injection due to Double Prepare approach CVSS 9.8 · 31.10.201729.11.20176.1WordPress Core < 4.9.1 - Reflected Cross-Site Scripting CVSS 6.1 · 29.11.20176.4WordPress Core < 4.9.1- Stored Cross-Site Scripting via Language CVSS 6.4 · 29.11.20176.4WordPress Core < 4.9.1 - Authenticated Stored Cross-Site Scripting CVSS 6.4 · 29.11.20175.4WordPress Core < 4.9.1 - Authorization Bypass CVSS 5.4 · 29.11.201716.01.20186.4WordPress Core < 4.9.2 - Authenticated Cross-Site Scripting CVSS 6.4 · 16.01.201805.02.20187.5WordPress Core < 5.0 - Denial of Service CVSS 7.5 · 05.02.201803.04.20186.4WordPress Core < 4.9.5 - Authenticated Stored Cross-Site Scripting via Generator Tag CVSS 6.4 · 03.04.20185.4WordPress Core < 4.9.5 - Open Redirect CVSS 5.4 · 03.04.20184.3WordPress Core < 4.9.5 - Security Misconfiguration with URL Hostnames CVSS 4.3 · 03.04.201805.07.20188.8WordPress Core < 4.9.7 - Authenticated Arbitrary File Deletion CVSS 8.8 · 05.07.201804.08.20186.6WordPress Core < 6.4.3 - Authenticated(Administrator+) PHP File Upload CVSS 6.6 · 04.08.201816.08.20188.8WordPress Core < 4.9 - Insecure Deserialization CVSS 8.8 · 16.08.201806.09.20187.5WordPress Core < 5.0.1 - PHAR Unserialization CVSS 7.5 · 06.09.201812.12.20186.4WordPress Core < 5.0.1 - Stored Cross-Site Scripting via File Uploads CVSS 6.4 · 12.12.20188.8WordPress Core < 5.0.1 - PHP Object Injection CVSS 8.8 · 12.12.20186.1WordPress Core < 5.0.1 Reflected Cross-Site Scripting CVSS 6.1 · 12.12.20187.5WordPress Core < 5.0.1 - Sensitive Information Disclosure CVSS 7.5 · 12.12.20184.3WordPress Core < 5.0.1 - Authorization Bypass CVSS 4.3 · 12.12.20186.4WordPress Core < 5.0.1 - Authenticated Stored Cross-Site Scripting via Comments CVSS 6.4 · 12.12.20187.7WordPress Core < 5.0.1 - Arbitrary File Deletion CVSS 7.7 · 12.12.201819.02.20198.8WordPress Core < 5.0.1 - Remote Code Execution CVSS 8.8 · 19.02.20196.5WordPress Core <= 5.0.3 - Path Traversal and Local File Inclusion CVSS 6.5 · 19.02.201912.04.20199.6WordPress Core < 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments CVSS 9.6 · 12.04.201905.09.20197.2WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments CVSS 7.2 · 05.09.20195.4WordPress Core < 5.2.3 - Reflected Cross-Site Scripting via Shortcode Previews CVSS 5.4 · 05.09.20196.4WordPress Core < 5.2.3 - Cross-Site Scripting via Media Uploads CVSS 6.4 · 05.09.20194.6WordPress Core < 5.2.3 - Open Redirect CVSS 4.6 · 05.09.20195.4WordPress Core < 5.2.3 - Authenticated Cross-Site Scripting via Post Previews CVSS 5.4 · 05.09.20196.4WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments via URLs CVSS 6.4 · 05.09.20196.1WordPress Core < 5.2.3 - Reflected Cross-Site Scripting CVSS 6.1 · 05.09.201914.10.20195.3WordPress Core < 5.2.4 - Authorization Bypass CVSS 5.3 · 14.10.20195.5WordPress Core < 5.2.4 - Authenticated Stored Cross-Site Scripting via Customizer CVSS 5.5 · 14.10.20197.3WordPress Core < 5.2.4 - Cache Poisoning CVSS 7.3 · 14.10.20195.5WordPress Core < 5.2.4 - Type Confusion CVSS 5.5 · 14.10.20195.4WordPress Core < 5.2.4 - Server Side Request Forgery #2 CVSS 5.4 · 14.10.20196.4WordPress Core < 5.2.4 - Authenticated Stored Cross-Site Scripting CVSS 6.4 · 14.10.20195.4WordPress Core < 5.2.4 - Server Side Request Forgery CVSS 5.4 · 14.10.201901.12.20194.3WordPress Core < 5.3.1 - Authorization Bypass CVSS 4.3 · 01.12.201913.12.20196.4WordPress Core < 5.3.1 - Authenticated Stored Cross-Site Scripting CVSS 6.4 · 13.12.20195.8WordPress Core < 5.3.1 - Authenticated Stored Cross-Site Scripting CVSS 5.8 · 13.12.20195.8WordPress Core < 5.3.1 - Stored Cross-Site Scripting via Block Editor CVSS 5.8 · 13.12.20196.4WordPress Core < 5.3.1 - Authenticated Stored Cross-Site Scripting CVSS 6.4 · 13.12.201929.04.20206.4WordPress Core < 5.4.1 - Cross-Site Scripting in the Block Editor CVSS 6.4 · 29.04.20206.1WordPress Core < 5.4.1 - Password Reset Link Non-Expiration CVSS 6.1 · 29.04.20205.8WordPress Core < 5.4.1 - Authenticated Cross-Site Scripting via Customizer CVSS 5.8 · 29.04.20205.8WordPress Core < 5.4.1 - Private Post Disclosure CVSS 5.8 · 29.04.20205.8WordPress Core < 5.4.1 - Reflected Cross Site Scripting CVSS 5.8 · 29.04.20206.4WordPress Core < 5.4.1 - Authenticated (Author+) Cross-Site Scripting via File Uploads CVSS 6.4 · 29.04.202010.06.20205.7WordPress Core < 5.4.2 - Open Redirect CVSS 5.7 · 10.06.20202.4WordPress Core < 5.4.2 - Self-Cross Site Scripting via Theme Folder Name CVSS 2.4 · 10.06.20203.5WordPress Core < 5.4.2 - Arbitrary User Meta Update CVSS 3.5 · 10.06.20205.3WordPress Core < 5.4.2 - Comment Disclosure CVSS 5.3 · 10.06.20206.8WordPress Core < 5.4.2 - Authenticated Stored Cross-Site Scripting CVSS 6.8 · 10.06.20205.4WordPress Core < 5.4.2 - Authenticated Stored Cross-Site Scripting CVSS 5.4 · 10.06.202029.10.20206.4WordPress Core < 5.5.2 - Stored Cross-Site Scripting via post slugs CVSS 6.4 · 29.10.20204.8WordPress Core < 5.5.2 - Misconfiguration That Allows Trigger of New Installation CVSS 4.8 · 29.10.20204.3WordPress Core < 5.5.2 - Cross-Site Request Forgery to Theme Image Change CVSS 4.3 · 29.10.20209.8WordPress Core < 5.5.3 - PHP Object Injection Gadget CVSS 9.8 · 29.10.20206.1WordPress Core < 5.5.2 - Reflected Cross-Site Scripting via Global Variables CVSS 6.1 · 29.10.20208.8WordPress Core < 5.5.2 - Deserialization Gadget CVSS 8.8 · 29.10.20204.3WordPress Core < 5.5.2 - Spam Embed on Multisite Installations CVSS 4.3 · 29.10.20208.8WordPress Core < 5.5.2 - Privilege Escalation via XML-RPC CVSS 8.8 · 29.10.20208.8WordPress Core < 5.5.2 - Privilege Escalation via XML-RPC CVSS 8.8 · 29.10.20205.4WordPress Core < 5.5.2 - Arbitrary File Deletion CVSS 5.4 · 29.10.202010.11.20215.3WordPress Core < 5.8.2 - ca-bundle.crt contains expired certificate DST Root CA X3 CVSS 5.3 · 10.11.202125.11.20218.1WordPress Core < 5.8 - Dependency Confusion CVSS 8.1 · 25.11.202111.03.20225.4WordPress Core < 5.9.2 & Gutenberg < 12.7.2 - Prototype Pollution via Block Editor CVSS 5.4 · 11.03.20228.8WordPress Core < 5.9.1 - jQuery Prototype Pollution CVSS 8.8 · 11.03.202230.08.20224.4WordPress Core < 6.0.2 - Stored Cross-Site Scripting via Plugin Deactivation and Deletion Errors CVSS 4.4 · 30.08.20228.0WordPress Core < 6.0.2 - Authenticated SQL Injection CVSS 8.0 · 30.08.20224.9WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function CVSS 4.9 · 30.08.202218.10.20228.8WordPress Core < 6.0.3 - Cross-Site Request Forgery via wp-trackback.php CVSS 8.8 · 18.10.20227.2WordPress Core < 6.0.3 - Stored Cross-Site Scripting via wp-mail.php CVSS 7.2 · 18.10.20225.3WordPress Core < 6.0.3 - Information Disclosure (Email Address) CVSS 5.3 · 18.10.20223.7WordPress Core < 6.0.3 - Information Disclosure (Multi-Part Email Leak) CVSS 3.7 · 18.10.20225.4WordPress Core < 6.0.3 - Open Redirect CVSS 5.4 · 18.10.20223.7WordPress Core < 6.0.3 - Shared User Instance Weakness CVSS 3.7 · 18.10.20225.5WordPress Core < 6.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Customizer CVSS 5.5 · 18.10.20226.4WordPress Core < 6.0.3 & Gutenberg < 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks CVSS 6.4 · 18.10.20224.3WordPress Core < 6.0.3 - Authenticated Information Disclosure via REST-API CVSS 4.3 · 18.10.20228.8WordPress Core < 6.0.3 - Reflected Cross-Site Scripting via SQL Injection CVSS 8.8 · 18.10.20229.8WordPress Core < 6.0.3 - SQL Injection via WP_Date_Query CVSS 9.8 · 18.10.20225.5WordPress Core < 6.0.3 - Authenticated (Editor+) Stored Cross-Site Scripting via Comments CVSS 5.5 · 18.10.202216.05.20234.3WordPress Core < 6.2.1 - Cross-Site Request Forgery CVSS 4.3 · 16.05.20236.4WordPress Core < 6.2.1 - Insufficient Sanitization of Block Attributes CVSS 6.4 · 16.05.20236.4WordPress Core < 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Embed Discovery CVSS 6.4 · 16.05.20235.4WordPress Core < 6.2.1 - Directory Traversal CVSS 5.4 · 16.05.202312.10.20234.3WordPress Core <= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts CVSS 4.3 · 12.10.20235.4WordPress Core < 6.3.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via parse-media-shortcode CVSS 5.4 · 12.10.202304.04.20245.3WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink CVSS 5.3 · 04.04.202424.06.20244.3WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal CVSS 4.3 · 24.06.202422.09.20256.4WordPress <= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 6.4 · 22.09.2025

Strategic Overview

Avg CVSSMedium
6.2/ 10
Patch Coverage100%
Open

0

Fixed

240

Get automatic notifications for all WordPress 2.9.2 vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8

WordPress Core < 6.0.3 - SQL Injection via WP_Date_Query

Read the full analysis

Vulnerability Records

240 records
2025-09-22 00:00
WordPress <= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting
WordPress 2.9.2
4.7 – 6.8.2 · 23 branches
CVE-2025-58674
6.4
Medium
SavPhill (Savphill)Yes
2024-06-24 00:00
WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal
WordPress 2.9.2
4.1 – 6.5.4 · 26 branches
CVE-2024-32111
4.3
Medium
apple502jYes
2024-04-04 00:00
WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink
WordPress 2.9.2
<= 6.4.3
CVE-2023-5692
5.3
Medium
Francesco CarlucciYes
2023-10-12 00:00
WordPress Core <= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts
WordPress 2.9.2
4.1.38 – 6.3.1 · 23 branches
CVE-2023-39999
4.3
Medium
Rafie MuhammadYes
2023-10-12 00:00
WordPress Core < 6.3.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via parse-media-shortcode
WordPress 2.9.2
4.1.38 – 6.3.1 · 23 branches
N/A
5.4
Medium
James GolovichYes
2023-05-16 00:00
WordPress Core < 6.2.1 - Cross-Site Request Forgery
WordPress 2.9.2
4.1 – < 6.2.1 · 23 branches
N/A
4.3
Medium
John BlackbournYes
2023-05-16 00:00
WordPress Core < 6.2.1 - Insufficient Sanitization of Block Attributes
WordPress 2.9.2
4.1 – < 6.2.1 · 23 branches
N/A
6.4
Medium
AnonymousYes
2023-05-16 00:00
WordPress Core < 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Embed Discovery
WordPress 2.9.2
4.1.38 – < 6.2.1 · 22 branches
N/A
6.4
Medium
Jakub ZoczekYes
2023-05-16 00:00
WordPress Core < 6.2.1 - Directory Traversal
WordPress 2.9.2
4.1.38 – < 6.2.1 · 22 branches
CVE-2023-2745
5.4
Medium
RamYes
2022-10-18 00:00
WordPress Core < 6.0.3 - Cross-Site Request Forgery via wp-trackback.php
WordPress 2.9.2
3.6.1 – 6.0.2 · 25 branches
N/A
8.8
High
Simon ScannellYes
Showing 1–10 of 240 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C