WordPress 5.2.23

WordPress 5.2.23 has 12 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2026; all 12 are fixed as of August 2026. Their average CVSS score is 5.5, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (25%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Insufficient Verification Of Data Authenticity.

Every one of the 12 issues recorded for WordPress 5.2.23 has a vendor fix available, so running the current release closes all known holes.

10 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

5.5/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WordPress 5.2.23 vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2021-44223

WordPress Core < 5.8 - Dependency Confusion

Read the full analysis

Vulnerability Records

12 records


2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds WordPress 5.2.23 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.3 Medium	Elio Gubser (odkdn1)	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery WordPress 5.2.23 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.8 Medium	Andrew MacPherson	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection WordPress 5.2.23 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.5 Medium	Anonymous	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass WordPress 5.2.23 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.3 Medium	0ways	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit WordPress 5.2.23 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.9 Medium	moochi	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite WordPress 5.2.23 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.3 Medium	Aikido Security	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Reflected Cross-Site Scripting via log Parameter WordPress 5.2.23 4.7.0 – 7.0.2 · 24 branches	`CVE-2026-64638`	6.1 Medium	pwn.ai Team	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element WordPress 5.2.23 4.7.0 – 7.0.2 · 24 branches	`N/A`	6.4 Medium	Asaf Mozes	Yes
2024-04-04 00:00	WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink WordPress 5.2.23 <= 6.4.3	`CVE-2023-5692`	5.3 Medium	Francesco Carlucci	Yes
2021-11-25 00:00	WordPress Core < 5.8 - Dependency Confusion WordPress 5.2.23 <= 5.7.5	`CVE-2021-44223`	8.1 High	Kamil Vavra	Yes

Showing 1–10 of 12 reports