sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total179
Critical16
High55
Medium106
Reset
Showing 61-80 of 179 records
Threat Entry Updated 2026-06-17

WordPress Core - Security Vulnerability (CVE-2020-11030)

In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the search block of the block editor. This requires an authenticated user with the ability to add content. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

CORE WordPress Core

CVE-2020-11030

MEDIUM CVSS 6.4 2020-04-30
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Security Vulnerability (CVE-2020-11028)

In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated disclosure under a specific set of conditions. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

CORE WordPress Core

CVE-2020-11028

MEDIUM CVSS 5.8 2020-04-30
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2020-11025)

In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).

CORE WordPress Core

CVE-2020-11025

MEDIUM CVSS 5.8 2020-04-30
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2019-20042)

In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

CORE WordPress Core

CVE-2019-20042

MEDIUM CVSS 6.1 2019-12-27
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Security Vulnerability (CVE-2019-20043)

In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

CORE WordPress Core

CVE-2019-20043

MEDIUM CVSS 4.3 2019-12-27
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2019-16781)

In WordPress before 5.3.1, authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.

CORE WordPress Core

CVE-2019-16781

MEDIUM CVSS 5.8 2019-12-26
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

WordPress Core - Cross-Site Scripting (XSS) (CVE-2019-16780)

WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. Automatic updates are enabled by default for minor releases and we strongly recommend that you keep them enabled.

CORE WordPress Core

CVE-2019-16780

MEDIUM CVSS 5.8 2019-12-26
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.