WordPress

Products

Exploited and recent CVEs

• CVE-2026-87902 High 8.1 Exploited An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for bot 95.8%
• CVE-2026-63030 Critical 9.8 Exploited WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution 10.6%
• CVE-2026-60137 Medium 5.9 Exploited WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query 5.3%
• CVE-2026-65640 High 8.8 WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server 1.9%
• CVE-2026-64638 High 8.9 WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be esc 0.9%
• CVE-2026-45293 High 8.6 WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability 0.2%
• CVE-2020-37233 Medium 6.4 WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting 0.3%
• CVE-2023-54333 High 8.2 Social-Share-Buttons 2.2.3 - SQL Injection via project_id Parameter 0.3%
• CVE-2025-58674 Medium 5.9 WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability 0.2%
• CVE-2025-58246 Medium 4.3 WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability 0.3%
• CVE-2025-54352 Low 3.7 WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior. 0.4%
• CVE-2024-31211 Medium 5.5 Remote Code Execution in `WP_HTML_Token` 2.7%
• CVE-2024-31210 High 7.7 PHP file upload bypass via Plugin installer 1.0%
• CVE-2023-5561 Medium 5.3 WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure 4.3%
• CVE-2022-3590 Medium 5.9 WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding 3.4%
• CVE-2022-21662 High 8.0 Stored XSS in WordPress 64.5%
• CVE-2022-21663 Medium 6.6 Authenticated Object Injection in Multisites in WordPress 3.8%
• CVE-2022-21664 High 7.4 SQL injection in WordPress 3.7%
• CVE-2022-21661 High 8.0 SQL injection in WordPress 97.8%
• CVE-2021-39203 Medium 6.8 Private data disclosure/privilege escalation through the block editor in Wordpress 0.9%
• CVE-2021-39202 High 7.6 WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widget 0.8%
• CVE-2021-39201 High 7.6 Authenticated cross-site scripting (XSS) in WordPress editor 1.5%
• CVE-2021-39200 Medium 5.3 Information Disclosure in wp_die() via JSONP in wordpress 2.0%
• CVE-2021-29476 Critical 9.8 Insecure Deserialization of untrusted data in rmccue/requests 2.1%
• CVE-2021-29450 Medium 6.5 WordPress Authenticated disclosure of password-protected posts and pages 2.1%
• CVE-2021-29447 High 7.1 WordPress Authenticated XXE attack when installation is running PHP 8 85.7%
• CVE-2020-4047 Medium 6.8 Authenticated XSS via media attachment page in WordPress 3.3%
• CVE-2020-4048 Medium 5.7 Open redirect in wp_validate_redirect() in WordPress 2.0%
• CVE-2020-4049 Low 2.4 Authenticated self-XSS via theme uploads in WordPress 2.5%
• CVE-2020-4050 Low 3.5 set-screen-option filter misuse by plugins leading to privilege escalation in WordPress 1.4%