GCVE - cpe:2.3:a:wordpress:wordpress:3.7.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:wordpress:wordpress:3.7.1:*:*:*:*:*:*:*

part: a version: 3.7.1 update: *

Vendor	Wordpress (`21977de4-0364-5ea6-90ad-48069434cf00`)
Product	Wordpress (`56378cf2-4348-590a-a4d7-419fcf17f3f1`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/wordpress/wordpress`	purl2cpe	2026-06-01 10:12:03.527045
`pkg:github/wordpress/wordpress-develop`	purl2cpe	2026-06-01 10:12:03.527047

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-14719`	vulnerable	2026-06-08 05:08:57.237347	Details available Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components. Published: 2017-09-23T20:00:00.000Z Updated: 2024-08-05T19:34:39.999Z Open on db.gcve.eu Reference links https://www.debian.org/security/2017/dsa-3997 http://www.securityfocus.com/bid/100912 http://www.securitytracker.com/id/1039553 https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/ https://wpvulndb.com/vulnerabilities/8911	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-5266`	vulnerable	2026-06-08 05:05:47.372614	Details available The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265. Published: 2014-08-18T10:00:00.000Z Updated: 2024-08-06T11:41:47.672Z Open on db.gcve.eu Reference links http://www.debian.org/security/2014/dsa-3001 https://wordpress.org/news/2014/08/wordpress-3-9-2/ https://www.drupal.org/SA-CORE-2014-004 http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830 http://www.debian.org/security/2014/dsa-2999	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-5265`	vulnerable	2026-06-08 05:05:47.356230	Details available The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. Published: 2014-08-18T10:00:00.000Z Updated: 2024-08-06T11:41:47.838Z Open on db.gcve.eu Reference links http://www.debian.org/security/2014/dsa-3001 https://wordpress.org/news/2014/08/wordpress-3-9-2/ https://www.drupal.org/SA-CORE-2014-004 http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830 http://www.debian.org/security/2014/dsa-2999	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-5240`	vulnerable	2026-06-08 05:05:47.241341	Details available Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL. Published: 2014-08-18T10:00:00.000Z Updated: 2024-08-06T11:41:47.780Z Open on db.gcve.eu Reference links http://www.debian.org/security/2014/dsa-3001 https://wordpress.org/news/2014/08/wordpress-3-9-2/ https://core.trac.wordpress.org/changeset/29398 http://openwall.com/lists/oss-security/2014/08/13/3	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.