WordPress 5.4
Approved changes feed: RSS · Atom
cpe:2.3:a:wordpress:wordpress:5.4:*:*:*:*:*:*:*
part: a version: 5.4 update: *
| Vendor | Wordpress (21977de4-0364-5ea6-90ad-48069434cf00) |
|---|---|
| Product | Wordpress (56378cf2-4348-590a-a4d7-419fcf17f3f1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wordpress/wordpress |
purl2cpe | 2026-06-01 10:12:03.528939 |
pkg:github/wordpress/wordpress-develop |
purl2cpe | 2026-06-01 10:12:03.528940 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-11029 |
vulnerable | 2026-06-08 05:16:36.336379 |
Cross-site scripting in stats method (object cache) in WordPress
MEDIUM (5.8)
In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited to execute cross-site scripting (XSS) attacks. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Published: 2020-04-30T22:15:18.000Z
Updated: 2024-08-04T11:21:14.187Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-11027 |
vulnerable | 2026-06-08 05:16:36.335197 |
Password reset links invalidation issue in WordPress
MEDIUM (6.1)
In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be needed to the email account of the user by a malicious party for successful execution. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Published: 2020-04-30T00:00:00.000Z
Updated: 2024-08-04T11:21:14.307Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-11026 |
vulnerable | 2026-06-08 05:16:36.334399 |
Specially crafted filenames in WordPress leading to XSS
HIGH (8.7)
In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon accessing the file. This requires an authenticated user with privileges to upload files. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
Published: 2020-04-30T22:15:32.000Z
Updated: 2024-08-04T11:21:14.284Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.