WordPress 3.8.28

WordPress 3.8.28 has 88 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2025; all 88 are fixed as of August 2026. Their average CVSS score is 6.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 18 high. 2020 was the busiest year with 22 disclosures.

The most common weakness is Cross-Site Scripting, behind 33 of the records (38%). Other recurring categories include Cross-Site Request Forgery (CSRF), Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 88 issues recorded for WordPress 3.8.28 has a vendor fix available, so running the current release closes all known holes.

55 independent researchers contributed these findings, most of them (8) reported by Simon Scannell.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WordPress 3.8.28 vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8

WordPress Core < 6.0.3 - SQL Injection via WP_Date_Query

Read the full analysis

Vulnerability Records

88 records


2025-09-22 00:00	WordPress <= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting WordPress 3.8.28 4.7 – 6.8.2 · 23 branches	`CVE-2025-58674`	6.4 Medium	SavPhill (Savphill)	Yes
2024-06-24 00:00	WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal WordPress 3.8.28 4.1 – 6.5.4 · 26 branches	`CVE-2024-32111`	4.3 Medium	apple502j	Yes
2024-04-04 00:00	WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink WordPress 3.8.28 <= 6.4.3	`CVE-2023-5692`	5.3 Medium	Francesco Carlucci	Yes
2023-10-12 00:00	WordPress Core <= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts WordPress 3.8.28 4.1.38 – 6.3.1 · 23 branches	`CVE-2023-39999`	4.3 Medium	Rafie Muhammad	Yes
2023-10-12 00:00	WordPress Core < 6.3.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via parse-media-shortcode WordPress 3.8.28 4.1.38 – 6.3.1 · 23 branches	`N/A`	5.4 Medium	James Golovich	Yes
2023-05-16 00:00	WordPress Core < 6.2.1 - Cross-Site Request Forgery WordPress 3.8.28 4.1 – < 6.2.1 · 23 branches	`N/A`	4.3 Medium	John Blackbourn	Yes
2023-05-16 00:00	WordPress Core < 6.2.1 - Insufficient Sanitization of Block Attributes WordPress 3.8.28 4.1 – < 6.2.1 · 23 branches	`N/A`	6.4 Medium	Anonymous	Yes
2023-05-16 00:00	WordPress Core < 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Embed Discovery WordPress 3.8.28 4.1.38 – < 6.2.1 · 22 branches	`N/A`	6.4 Medium	Jakub Zoczek	Yes
2023-05-16 00:00	WordPress Core < 6.2.1 - Directory Traversal WordPress 3.8.28 4.1.38 – < 6.2.1 · 22 branches	`CVE-2023-2745`	5.4 Medium	Ram	Yes
2022-10-18 00:00	WordPress Core < 6.0.3 - Cross-Site Request Forgery via wp-trackback.php WordPress 3.8.28 3.6.1 – 6.0.2 · 25 branches	`N/A`	8.8 High	Simon Scannell	Yes

Showing 1–10 of 88 reports