GCVE - cpe:2.3:a:wordpress:wordpress:3.9.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:wordpress:wordpress:3.9.1:*:*:*:*:*:*:*

part: a version: 3.9.1 update: *

Vendor	Wordpress (`21977de4-0364-5ea6-90ad-48069434cf00`)
Product	Wordpress (`56378cf2-4348-590a-a4d7-419fcf17f3f1`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/wordpress/wordpress`	purl2cpe	2026-06-01 10:12:03.527303
`pkg:github/wordpress/wordpress-develop`	purl2cpe	2026-06-01 10:12:03.527305

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-14719`	vulnerable	2026-06-08 05:08:57.259824	Details available Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components. Published: 2017-09-23T20:00:00.000Z Updated: 2024-08-05T19:34:39.999Z Open on db.gcve.eu Reference links https://www.debian.org/security/2017/dsa-3997 http://www.securityfocus.com/bid/100912 http://www.securitytracker.com/id/1039553 https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/ https://wpvulndb.com/vulnerabilities/8911	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3439`	vulnerable	2026-06-08 05:06:38.294275	Details available Cross-site scripting (XSS) vulnerability in the Ephox (formerly Moxiecode) plupload.flash.swf shim 2.1.2 in Plupload, as used in WordPress 3.9.x, 4.0.x, and 4.1.x before 4.1.2 and other products, allows remote attackers to execute same-origin JavaScript functions via the target parameter, as demonstrated by executing a certain click function, related to _init.as and _fireEvent.as. Published: 2015-08-05T10:00:00.000Z Updated: 2024-08-06T05:47:57.771Z Open on db.gcve.eu Reference links http://zoczus.blogspot.com/2015/04/plupload-same-origin-method-execution.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157391.html https://wordpress.org/news/2015/04/wordpress-4-1-2/ https://wpvulndb.com/vulnerabilities/7933 http://www.securityfocus.com/bid/74269	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9039`	vulnerable	2026-06-08 05:06:10.684306	Details available wp-login.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to reset passwords by leveraging access to an e-mail account that received a password-reset message. Published: 2014-11-25T23:00:00.000Z Updated: 2024-08-06T13:33:13.527Z Open on db.gcve.eu Reference links http://www.debian.org/security/2014/dsa-3085 http://openwall.com/lists/oss-security/2014/11/25/12 http://advisories.mageia.org/MGASA-2014-0493.html http://core.trac.wordpress.org/changeset/30431 http://www.securitytracker.com/id/1031243	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9038`	vulnerable	2026-06-08 05:06:10.683464	Details available wp-includes/http.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to conduct server-side request forgery (SSRF) attacks by referring to a 127.0.0.0/8 resource. Published: 2014-11-25T23:00:00.000Z Updated: 2024-08-06T13:33:13.352Z Open on db.gcve.eu Reference links http://www.debian.org/security/2014/dsa-3085 http://openwall.com/lists/oss-security/2014/11/25/12 https://core.trac.wordpress.org/changeset/30444 http://advisories.mageia.org/MGASA-2014-0493.html http://www.securitytracker.com/id/1031243	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9037`	vulnerable	2026-06-08 05:06:10.682699	Details available WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 might allow remote attackers to obtain access to an account idle since 2008 by leveraging an improper PHP dynamic type comparison for an MD5 hash. Published: 2014-11-25T23:00:00.000Z Updated: 2024-08-06T13:33:13.510Z Open on db.gcve.eu Reference links http://www.debian.org/security/2014/dsa-3085 http://openwall.com/lists/oss-security/2014/11/25/12 http://advisories.mageia.org/MGASA-2014-0493.html http://www.securitytracker.com/id/1031243 http://www.mandriva.com/security/advisories?name=MDVSA-2014:233	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9036`	vulnerable	2026-06-08 05:06:10.677059	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9035`	vulnerable	2026-06-08 05:06:10.676341	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9034`	vulnerable	2026-06-08 05:06:10.675624	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9032`	vulnerable	2026-06-08 05:06:10.671995	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9031`	vulnerable	2026-06-08 05:06:10.670881	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-5203`	vulnerable	2026-06-08 05:05:47.146669	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.