wordpressdotorg
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| OpenStation – Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA | 1 | – | Oct 30, 2026 |
| WordPress Importer | 1 | – | Mar 26, 2025 |
Exploited and recent CVEs
- CVE-2026-109592 OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/<id> on orphaned placements 0.3%
- CVE-2024-13889 WordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object Injection 0.8%