Wondercms is a lightweight content management system with a narrow product footprint that has attracted vulnerability interest disproportionate to its deployment scale. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity and a frequent tendency toward public exploit availability, reflecting the platform's appeal as a target for proof-of-concept development and security research. The exposure recurs consistently through web-application input-handling and access-control weakness classes, including cross-site scripting, server-side request forgery, path traversal, cross-site request forgery, and sensitive-information disclosure, which are characteristic of lightweight CMS platforms that prioritize feature simplicity over defense-in-depth. Defenders deploying this platform should apply updates promptly and implement network-level protections; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wondercms over time
Signals from CVEs in this vendor scope (37 CVEs).
37 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-41425MEDIUM Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule componen | Nov 7, 2023 | 6.1 | 71 | NO | YES |
CVE-2020-35313CRITICAL A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code | Apr 20, 2021 | 9.8 | 67 | NO | YES |
CVE-2020-35314CRITICAL A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custom plugin which can co | Apr 20, 2021 | 9.8 | 57 | NO | YES |
CVE-2017-14521HIGH In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload. | Jan 26, 2018 | 8.8 | 41 | NO | YES |
CVE-2017-14523HIGH WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because | Jan 26, 2018 | 7.5 | 37 | NO | YES |
CVE-2014-8705CRITICAL PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter. | Mar 17, 2017 | 9.8 | 30 | NO | NO |
CVE-2014-8704CRITICAL Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme. | Mar 17, 2017 | 9.8 | 30 | NO | NO |
CVE-2017-7951HIGH WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context. | Apr 21, 2017 | 8.8 | 28 | NO | NO |
CVE-2020-29469MEDIUM WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. This vulnerability can allow an attacker to inject the XSS payload in the Setting - Menu and each t | Dec 30, 2020 | 5.4 | 27 | NO | YES |
CVE-2020-29233MEDIUM WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allow an attacker to inject the XSS payload in the Page descript | Dec 30, 2020 | 5.4 | 27 | NO | YES |
Signals from CVEs in this vendor scope (37 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wondercms.
Media articles that mention a CVE ID that affects a product developed by Wondercms — matched by CVE ID, not by vendor name.