WordPress 4.6.19

WordPress 4.6.19 has 48 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2025; all 48 are fixed as of August 2026. Their average CVSS score is 6.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 14 high. 2022 was the busiest year with 20 disclosures.

The most common weakness is Cross-Site Scripting, behind 13 of the records (27%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, SQL Injection.

Every one of the 48 issues recorded for WordPress 4.6.19 has a vendor fix available, so running the current release closes all known holes.

34 independent researchers contributed these findings, most of them (5) reported by Alex Concha.

01234567891020.06.2012Today20.06.20123.7WordPress Core - Informational < 6.8 - Weak Hashing Algorithm CVSS 3.7 · 20.06.201203.05.20175.9Wordpress Core < 5.5 - Unauthorized Password Reset via Interception CVSS 5.9 · 03.05.201705.02.20187.5WordPress Core < 5.0 - Denial of Service CVSS 7.5 · 05.02.201804.08.20186.6WordPress Core < 6.4.3 - Authenticated(Administrator+) PHP File Upload CVSS 6.6 · 04.08.201816.08.20188.8WordPress Core < 4.9 - Insecure Deserialization CVSS 8.8 · 16.08.201819.02.20196.5WordPress Core <= 5.0.3 - Path Traversal and Local File Inclusion CVSS 6.5 · 19.02.201929.10.20206.4WordPress Core < 5.5.2 - Stored Cross-Site Scripting via post slugs CVSS 6.4 · 29.10.20204.8WordPress Core < 5.5.2 - Misconfiguration That Allows Trigger of New Installation CVSS 4.8 · 29.10.20204.3WordPress Core < 5.5.2 - Cross-Site Request Forgery to Theme Image Change CVSS 4.3 · 29.10.20209.8WordPress Core < 5.5.3 - PHP Object Injection Gadget CVSS 9.8 · 29.10.20206.1WordPress Core < 5.5.2 - Reflected Cross-Site Scripting via Global Variables CVSS 6.1 · 29.10.20208.8WordPress Core < 5.5.2 - Deserialization Gadget CVSS 8.8 · 29.10.20204.3WordPress Core < 5.5.2 - Spam Embed on Multisite Installations CVSS 4.3 · 29.10.20208.8WordPress Core < 5.5.2 - Privilege Escalation via XML-RPC CVSS 8.8 · 29.10.20208.8WordPress Core < 5.5.2 - Privilege Escalation via XML-RPC CVSS 8.8 · 29.10.20205.4WordPress Core < 5.5.2 - Arbitrary File Deletion CVSS 5.4 · 29.10.202006.01.20218.0WordPress Core < 5.8.3 - SQL Injection via WP_Query CVSS 8.0 · 06.01.202110.11.20215.3WordPress Core < 5.8.2 - ca-bundle.crt contains expired certificate DST Root CA X3 CVSS 5.3 · 10.11.202125.11.20218.1WordPress Core < 5.8 - Dependency Confusion CVSS 8.1 · 25.11.202106.01.20227.4WordPress Core < 5.8.3 - SQL Injection via WP_Meta_Query CVSS 7.4 · 06.01.20226.6WordPress Core < 5.8.3 - Super Admin Multi-Site Installation Object Injection CVSS 6.6 · 06.01.20228.0WordPress Core < 5.8.3 - Authenticated (Author+) Stored Cross Site Scripting CVSS 8.0 · 06.01.202211.03.20225.4WordPress Core < 5.9.2 & Gutenberg < 12.7.2 - Prototype Pollution via Block Editor CVSS 5.4 · 11.03.20228.8WordPress Core < 5.9.1 - jQuery Prototype Pollution CVSS 8.8 · 11.03.202230.08.20224.4WordPress Core < 6.0.2 - Stored Cross-Site Scripting via Plugin Deactivation and Deletion Errors CVSS 4.4 · 30.08.20228.0WordPress Core < 6.0.2 - Authenticated SQL Injection CVSS 8.0 · 30.08.20224.9WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function CVSS 4.9 · 30.08.202218.10.20228.8WordPress Core < 6.0.3 - Cross-Site Request Forgery via wp-trackback.php CVSS 8.8 · 18.10.20227.2WordPress Core < 6.0.3 - Stored Cross-Site Scripting via wp-mail.php CVSS 7.2 · 18.10.20225.3WordPress Core < 6.0.3 - Information Disclosure (Email Address) CVSS 5.3 · 18.10.20223.7WordPress Core < 6.0.3 - Information Disclosure (Multi-Part Email Leak) CVSS 3.7 · 18.10.20225.4WordPress Core < 6.0.3 - Open Redirect CVSS 5.4 · 18.10.20223.7WordPress Core < 6.0.3 - Shared User Instance Weakness CVSS 3.7 · 18.10.20225.5WordPress Core < 6.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting via Customizer CVSS 5.5 · 18.10.20226.4WordPress Core < 6.0.3 & Gutenberg < 14.3.1 - Authenticated Cross-Site Scripting in Various Blocks CVSS 6.4 · 18.10.20224.3WordPress Core < 6.0.3 - Authenticated Information Disclosure via REST-API CVSS 4.3 · 18.10.20228.8WordPress Core < 6.0.3 - Reflected Cross-Site Scripting via SQL Injection CVSS 8.8 · 18.10.20229.8WordPress Core < 6.0.3 - SQL Injection via WP_Date_Query CVSS 9.8 · 18.10.20225.5WordPress Core < 6.0.3 - Authenticated (Editor+) Stored Cross-Site Scripting via Comments CVSS 5.5 · 18.10.202216.05.20234.3WordPress Core < 6.2.1 - Cross-Site Request Forgery CVSS 4.3 · 16.05.20236.4WordPress Core < 6.2.1 - Insufficient Sanitization of Block Attributes CVSS 6.4 · 16.05.20236.4WordPress Core < 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Embed Discovery CVSS 6.4 · 16.05.20235.4WordPress Core < 6.2.1 - Directory Traversal CVSS 5.4 · 16.05.202312.10.20234.3WordPress Core <= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts CVSS 4.3 · 12.10.20235.4WordPress Core < 6.3.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via parse-media-shortcode CVSS 5.4 · 12.10.202304.04.20245.3WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink CVSS 5.3 · 04.04.202424.06.20244.3WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal CVSS 4.3 · 24.06.202422.09.20256.4WordPress <= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting CVSS 6.4 · 22.09.2025

Strategic Overview

Avg CVSSMedium
6.3/ 10
Patch Coverage100%
Open

0

Fixed

48

Get automatic notifications for all WordPress 4.6.19 vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8

WordPress Core < 6.0.3 - SQL Injection via WP_Date_Query

Read the full analysis

Vulnerability Records

48 records
2025-09-22 00:00
WordPress <= 6.8.2 - Authenticated (Author+) Stored Cross-Site Scripting
WordPress 4.6.19
4.7 – 6.8.2 · 23 branches
CVE-2025-58674
6.4
Medium
SavPhill (Savphill)Yes
2024-06-24 00:00
WordPress Core < 6.5.5 - Authenticated (Contributor+) Directory Traversal
WordPress 4.6.19
4.1 – 6.5.4 · 26 branches
CVE-2024-32111
4.3
Medium
apple502jYes
2024-04-04 00:00
WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink
WordPress 4.6.19
<= 6.4.3
CVE-2023-5692
5.3
Medium
Francesco CarlucciYes
2023-10-12 00:00
WordPress Core <= 6.3.1 - Authenticated(Contributor+) Sensitive Information Exposure via Comments on Protected Posts
WordPress 4.6.19
4.1.38 – 6.3.1 · 23 branches
CVE-2023-39999
4.3
Medium
Rafie MuhammadYes
2023-10-12 00:00
WordPress Core < 6.3.2 – Authenticated (Subscriber+) Arbitrary Shortcode Execution via parse-media-shortcode
WordPress 4.6.19
4.1.38 – 6.3.1 · 23 branches
N/A
5.4
Medium
James GolovichYes
2023-05-16 00:00
WordPress Core < 6.2.1 - Cross-Site Request Forgery
WordPress 4.6.19
4.1 – < 6.2.1 · 23 branches
N/A
4.3
Medium
John BlackbournYes
2023-05-16 00:00
WordPress Core < 6.2.1 - Insufficient Sanitization of Block Attributes
WordPress 4.6.19
4.1 – < 6.2.1 · 23 branches
N/A
6.4
Medium
AnonymousYes
2023-05-16 00:00
WordPress Core < 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Embed Discovery
WordPress 4.6.19
4.1.38 – < 6.2.1 · 22 branches
N/A
6.4
Medium
Jakub ZoczekYes
2023-05-16 00:00
WordPress Core < 6.2.1 - Directory Traversal
WordPress 4.6.19
4.1.38 – < 6.2.1 · 22 branches
CVE-2023-2745
5.4
Medium
RamYes
2022-10-18 00:00
WordPress Core < 6.0.3 - Cross-Site Request Forgery via wp-trackback.php
WordPress 4.6.19
3.6.1 – 6.0.2 · 25 branches
N/A
8.8
High
Simon ScannellYes
Showing 1–10 of 48 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C