Packages / Debian 13 (Trixie) / web / wordpress

Package: wordpress (6.8.3+dfsg1-0+deb13u1)

weblog manager

Other Packages Related to wordpress:

dep: [apache2]
Apache HTTP Server
dep: httpd
Package not available
dep: [libapache2-mod-php]
server-side, HTML-embedded scripting language (Apache 2 module) (default)
dep: [php]
server-side, HTML-embedded scripting language (default)
dep: [ca-certificates]
Common CA certificates
dep: [default-mysql-client]
MySQL database client binaries (metapackage)
dep: virtual-mysql-client
Package not available
dep: [php-gd]
GD module for PHP [default]
dep: [php-mysql]
MySQL module for PHP [default]
dep: php-mysqlnd
Package not available
dep: [libjs-cropper] (>= 1.2.2)
JavaScript image cropper UI
dep: [libjs-lodash] (>= 4.17.21+dfsg+~cs8.31.198.20210220)
Lo-dash is a Javascript utility library
dep: [libjs-underscore] (>= 1.13.4~dfsg+~1.11.4)
JavaScript's functional programming helper library
dep: [php-getid3] (>= 1.9.23+dfsg)
scripts to extract information from multimedia files

rec: [wordpress-l10n]
weblog manager - language files
rec: [wordpress-theme-twentytwentyfive]
weblog manager - twentytwentyfive theme files

sug: [default-mysql-server]
MySQL database server binaries and system database setup (metapackage)
sug: virtual-mysql-server
Package not available
sug: [php-curl]
CURL module for PHP [default]
sug: [php-xml]
DOM, SimpleXML, WDDX, XML, and XSL module for PHP [default]
sug: [php-imagick]
Provides a wrapper to the ImageMagick library
sug: [php-mbstring]
MBSTRING module for PHP [default]
sug: [php-ssh2]
Bindings for the libssh2 library
sug: [php-zip]
Zip module for PHP [default]

Download wordpress

Architecture	Package size	Installed size	Files	Package
all	8.5 MiB	58 MiB	list of files	Download

Package file paths (0)

Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.

No package-associated file paths were observed for the displayed build metadata.

Field source: Debian 13 (Trixie) main amd64

Use this package

OpenFactory can boot this operating system in a browser VM, or start a build that includes the native package name from this record.

Try Debian 13 (Trixie) in the browser Build an image that includes wordpress

Versions, suites, and repositories

Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.

Version	Release	Architecture	Repository	Package size	Installed size	Publisher repository artifact
6.8.3+dfsg1-0+deb13u1	trixie / main	all	Debian 13 · main · amd64	8.5 MiB	58 MiB	pool/main/w/wordpress/wordpress_6.8.3+dfsg1-0+deb13u1_all.deb
6.8.3+dfsg1-0+deb13u1	trixie / main	all	Debian 13 · main · arm64	8.5 MiB	58 MiB	pool/main/w/wordpress/wordpress_6.8.3+dfsg1-0+deb13u1_all.deb

Field source: Debian 13 (Trixie) main amd64

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVE	Severity	Version impact
[CVE-2026-66666] Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through	Medium(6.9)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 7:40:36 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Affected nvd · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Affected nvd · wordpress · debian · 13
[CVE-2026-87902] An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for bot	High(8.1) CISA KEV	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 8:36:13 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Affected · Fixed: `6.8.10+dfsg1-0+deb13u1` nvd · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Affected · Fixed: `6.8.10+dfsg1-0+deb13u1` nvd · wordpress · debian · 13
[CVE-2026-93485] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through	High(7.1)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 8:36:57 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Affected · Fixed: `6.8.10+dfsg1-0+deb13u1` nvd · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Affected · Fixed: `6.8.10+dfsg1-0+deb13u1` nvd · wordpress · debian · 13
[CVE-2026-65640] WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server	High(8.8)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 9:42:05 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Affected · Fixed: `6.8.10+dfsg1-0+deb13u1` nvd · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Affected · Fixed: `6.8.10+dfsg1-0+deb13u1` nvd · wordpress · debian · 13
[CVE-2026-64638] WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be esc	High(8.9)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 9:42:37 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Affected · Fixed: `6.8.7+dfsg1-0+deb13u1` nvd · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Affected · Fixed: `6.8.7+dfsg1-0+deb13u1` nvd · wordpress · debian · 13
[CVE-2026-60137] WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme pas	Critical(9.1) CISA KEV	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 9:44:13 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Affected · Fixed: `6.8.6+dfsg1-0+deb13u1` nvd · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Affected · Fixed: `6.8.6+dfsg1-0+deb13u1` nvd · wordpress · debian · 13
[CVE-2011-1762] wordpress: CVE-2011-1762	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:05:23 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `3.2.1+dfsg-1` dsa · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `3.2.1+dfsg-1` dsa · wordpress · debian · 13
[CVE-2021-44223] wordpress: CVE-2021-44223	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 6:03:32 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.8.1+dfsg1-1` dsa · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.8.1+dfsg1-1` dsa · wordpress · debian · 13
[CVE-2021-39201] wordpress: CVE-2021-39201	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 6:01:56 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.8.1+dfsg1-1` dsa · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.8.1+dfsg1-1` dsa · wordpress · debian · 13
[CVE-2021-39200] wordpress: CVE-2021-39200	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 6:01:56 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.8.1+dfsg1-1` dsa · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.8.1+dfsg1-1` dsa · wordpress · debian · 13
[CVE-2021-29476] wordpress: CVE-2021-29476	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:56:12 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13
[CVE-2021-29450] wordpress: CVE-2021-29450	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:56:12 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.7.1+dfsg1-1` dsa · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.7.1+dfsg1-1` dsa · wordpress · debian · 13
[CVE-2021-29447] wordpress: CVE-2021-29447	Low	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:56:12 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.7.1+dfsg1-1` dsa · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.7.1+dfsg1-1` dsa · wordpress · debian · 13
[CVE-2020-28040] wordpress: CVE-2020-28040	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:51:06 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13
[CVE-2020-28039] wordpress: CVE-2020-28039	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:51:06 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13
[CVE-2020-28038] wordpress: CVE-2020-28038	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:51:06 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13
[CVE-2020-28037] wordpress: CVE-2020-28037	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:51:06 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13
[CVE-2020-28036] wordpress: CVE-2020-28036	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:51:06 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13
[CVE-2020-28035] wordpress: CVE-2020-28035	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:51:06 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13
[CVE-2020-28034] wordpress: CVE-2020-28034	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:51:06 PM UTC Details (2) `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13 `6.8.3+dfsg1-0+deb13u1` · all · trixie Fixed · Fixed: `5.5.3+dfsg1-1` dsa · wordpress · debian · 13

[Next results]

Last synced: Oct 24, 2026, 2:22:43 AM UTC

[CVE catalog]

Checksums

Repository signatures authenticate metadata. Artifact hashing is recorded separately. Neither establishes package safety.

6.8.3+dfsg1-0+deb13u1 / allObserved Sep 1, 2026sha256 51683e0ced13…7eb351edSource-reported digest

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Source-reported digest (sha256): 51683e0ced1391108b06f4c2e5e26ff6a4793f204e8d6aa38a42bf207eb351ed

Verify download

printf '%s  %s\n' '51683e0ced1391108b06f4c2e5e26ff6a4793f204e8d6aa38a42bf207eb351ed' 'wordpress_6.8.3+dfsg1-0+deb13u1_all.deb' | sha256sum --check --strict -

Field source: Debian 13 (Trixie) main amd64

6.8.3+dfsg1-0+deb13u1 / allObserved Sep 1, 2026sha256 51683e0ced13…7eb351edSource-reported digest

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Source-reported digest (sha256): 51683e0ced1391108b06f4c2e5e26ff6a4793f204e8d6aa38a42bf207eb351ed

Verify download

printf '%s  %s\n' '51683e0ced1391108b06f4c2e5e26ff6a4793f204e8d6aa38a42bf207eb351ed' 'wordpress_6.8.3+dfsg1-0+deb13u1_all.deb' | sha256sum --check --strict -

Field source: Debian 13 (Trixie) main arm64

Sources

Debian 13 (Trixie) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-main-amd64:3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/trixie/InRelease
Signed-object SHA-256
98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Observed SHA-256
3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Result
match verified
Debian 13 (Trixie) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-main-arm64:753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/trixie/InRelease
Signed-object SHA-256
98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Observed SHA-256
753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Result
match verified
Debian 13 (Trixie) security main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-security-main-arm64:a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
Repository-signature verification record
Signed object
https://security.debian.org/debian-security/dists/trixie-security/InRelease
Signed-object SHA-256
fb4f5284b755510aafc1d8a39ef966c7ef714aaab3ecc24baae0a67c38518ab5
Signer fingerprint
B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
Observed SHA-256
a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
Result
match verified
Debian SecurityOct 24, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-security-main-amd64:80abc7ace801ccb58732fe448148850e3078f925942b034fe532c371f804c2a0
Repository-signature verification record
Signed object
https://security.debian.org/debian-security/dists/trixie-security/InRelease
Signed-object SHA-256
2dc86861c04386d3c511340d4f011a37acfd1cccdf3dbd3e054d6fe8e4118ebc
Signer fingerprint
B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Oct 24, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
80abc7ace801ccb58732fe448148850e3078f925942b034fe532c371f804c2a0
Observed SHA-256
80abc7ace801ccb58732fe448148850e3078f925942b034fe532c371f804c2a0
Result
match verified
Debian SecurityAug 10, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-security-main-amd64:8f5dc49314d649a91096047bfb3fdedd8ecda3f9c698aa877620bc59441df350
Repository-signature verification record
This legacy snapshot retains only the prior status and artifact digest. A verified source refresh is required before this record is auditable.
Debian SecuritySep 28, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-security-main-amd64:e87c5ab9dc4a50e68f12384ada558ff9e7c30fa218519247ca837f2e9a85eefc
Repository-signature verification record
Signed object
https://security.debian.org/debian-security/dists/trixie-security/InRelease
Signed-object SHA-256
ecdc868f2af3aea6076aeca64a580183a1828d99a1f80e9ef7362dc1e371148b
Signer fingerprint
B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 28, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
e87c5ab9dc4a50e68f12384ada558ff9e7c30fa218519247ca837f2e9a85eefc
Observed SHA-256
e87c5ab9dc4a50e68f12384ada558ff9e7c30fa218519247ca837f2e9a85eefc
Result
match verified