GCVE - cpe:2.3:a:wordpress:wordpress:3.5.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:wordpress:wordpress:3.5.0:*:*:*:*:*:*:*

part: a version: 3.5.0 update: *

Vendor	Wordpress (`21977de4-0364-5ea6-90ad-48069434cf00`)
Product	Wordpress (`56378cf2-4348-590a-a4d7-419fcf17f3f1`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/wordpress/wordpress`	purl2cpe	2026-06-01 10:12:03.526988
`pkg:github/wordpress/wordpress-develop`	purl2cpe	2026-06-01 10:12:03.526990

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-5266`	vulnerable	2026-06-08 05:05:47.372534	Details available The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265. Published: 2014-08-18T10:00:00.000Z Updated: 2024-08-06T11:41:47.672Z Open on db.gcve.eu Reference links http://www.debian.org/security/2014/dsa-3001 https://wordpress.org/news/2014/08/wordpress-3-9-2/ https://www.drupal.org/SA-CORE-2014-004 http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830 http://www.debian.org/security/2014/dsa-2999	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-5265`	vulnerable	2026-06-08 05:05:47.355989	Details available The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. Published: 2014-08-18T10:00:00.000Z Updated: 2024-08-06T11:41:47.838Z Open on db.gcve.eu Reference links http://www.debian.org/security/2014/dsa-3001 https://wordpress.org/news/2014/08/wordpress-3-9-2/ https://www.drupal.org/SA-CORE-2014-004 http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830 http://www.debian.org/security/2014/dsa-2999	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-5240`	vulnerable	2026-06-08 05:05:47.238611	Details available Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL. Published: 2014-08-18T10:00:00.000Z Updated: 2024-08-06T11:41:47.780Z Open on db.gcve.eu Reference links http://www.debian.org/security/2014/dsa-3001 https://wordpress.org/news/2014/08/wordpress-3-9-2/ https://core.trac.wordpress.org/changeset/29398 http://openwall.com/lists/oss-security/2014/08/13/3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0166`	vulnerable	2026-06-08 05:05:11.985086	Details available The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie. Published: 2014-04-09T23:00:00.000Z Updated: 2024-08-06T09:05:39.053Z Open on db.gcve.eu Reference links http://codex.wordpress.org/Version_3.7.2 https://bugzilla.redhat.com/show_bug.cgi?id=1085858 http://codex.wordpress.org/Version_3.8.2 http://www.debian.org/security/2014/dsa-2901 http://core.trac.wordpress.org/changeset/28054	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0165`	vulnerable	2026-06-08 05:05:11.978899	Details available WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php. Published: 2014-04-09T23:00:00.000Z Updated: 2024-08-06T09:05:38.797Z Open on db.gcve.eu Reference links http://codex.wordpress.org/Version_3.7.2 http://core.trac.wordpress.org/changeset/27976 http://codex.wordpress.org/Version_3.8.2 http://www.debian.org/security/2014/dsa-2901 https://bugzilla.redhat.com/show_bug.cgi?id=1085866	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2205`	vulnerable	2026-06-08 05:04:23.384150	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2204`	vulnerable	2026-06-08 05:04:23.381427	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2203`	vulnerable	2026-06-08 05:04:23.353420	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2202`	vulnerable	2026-06-08 05:04:23.351189	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2201`	vulnerable	2026-06-08 05:04:23.348923	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2200`	vulnerable	2026-06-08 05:04:23.346905	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2199`	vulnerable	2026-06-08 05:04:23.344351	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.