WordPress Foundation

Products

Exploited and recent CVEs

• CVE-2026-119977 High 8.1 Exploited WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution 1.2%
• CVE-2026-114570 Medium 4.9 WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit 0.2%
• CVE-2026-3906 Medium 4.3 WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API 0.4%
• CVE-2022-4973 Medium 4.9 WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function 0.4%
• CVE-2024-6307 Medium 6.4 WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API 0.5%
• CVE-2024-4439 High 7.2 WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This mak 71.0%
• CVE-2023-5692 Medium 5.3 WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink 0.8%
• CVE-2023-2745 Medium 5.4 WordPress Core < 6.2.1 - Directory Traversal 79.7%