CVE stands for Common Vulnerabilities and Exposures, which is an industry standard way to track security issues in software applications. They are tracked centrally in the National Vulnerability Database 2. NVD is a product of the NIST Computer Security Division.

Although many CVEs mention WordPress, only a few are applicable. Here is a list of CVEs that mention WordPress, organized by year, and whether the CVE impacts WordPress Plugins, the core programming, WordPress.com, or another aspect of WordPress, as well as which version of WordPress was impacted. The Date used is the date of the report going public and not the day the vulnerability was discovered.

In terms of security of your WordPress blog, being on the latest version of WordPress is all you need. WordPress generally fixes vulnerabilities and releases an upgrade or security update version before they become public and are issued a CVE.

WordPress uses third party applications like the Apache webserver, the PHP scripting language and the MySQL database. You should keep these versions current as well. Reports for these third party applications are not listed on this page.

Additionally you can take precaution actions by using Suhosin, an advanced protection system for PHP installations.

2010

1 total CVEs, 1 apply to core, 0 to legacy, and 0 are invalid. (for 2010 only core CVEs listed here)

2009

16 total CVEs, 1 apply to plugins, 15 apply to core, 0 to legacy, and 0 are invalid. (for 2009 mostly core CVEs listed here, too many plugins)

2008

59 total CVEs, 40 apply to plugins, 10 apply to core, 3 to legacy, and 6 are invalid.

See Also

• User:Here/Exploits