All · WordPress

Newest first. Every filter here is also a feed: see the subscribe box.

1. 8.1high
   CVE-2026-119977WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

   KEVEPSS 1.2% chance of exploitation in 30 days, percentile 67%EPSS 1.2%WordPress
   7 d ago 2026-10-31
2. 4.9med
   CVE-2026-114570WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

   WordPress
   16 d ago 2026-10-22
3. 8.1high
   CVE-2026-87902An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the…

   KEV1 exploitEPSS 95.8% chance of exploitation in 30 days, percentile 100%EPSS 95.8%WordPress
   45 d ago 2026-09-22
4. 8.8high
   CVE-2026-65640WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.

   EPSS 1.9% chance of exploitation in 30 days, percentile 80%EPSS 1.9%WordPress
   2 mo ago 2026-08-17
5. 8.9high
   CVE-2026-64638WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.

   WordPress
   3 mo ago 2026-08-07
6. 9.8crit
   CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

   KEVEPSS 10.6% chance of exploitation in 30 days, percentile 96%EPSS 10.6%WordPress
   3 mo ago 2026-07-17
7. 5.9med
   CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

   KEVEPSS 5.3% chance of exploitation in 30 days, percentile 93%EPSS 5.3%WordPress
   3 mo ago 2026-07-17
8. 4.3med
   CVE-2026-3906WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API

   WordPress
   7 mo ago 2026-03-11
9. 5.9med
   CVE-2025-58674WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability

   WordPress
   13 mo ago 2025-09-23
10. 4.3med
    CVE-2025-58246WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability

    WordPress
    13 mo ago 2025-09-23
11. 3.7low
    CVE-2025-54352WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests.

    WordPress
    15 mo ago 2025-07-21
12. 4.9med
    CVE-2022-4973WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function

    WordPress
    2 y ago 2024-10-16
13. 6.4med
    CVE-2024-6307WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API

    WordPress
    2 y ago 2024-06-25
14. 7.2high
    CVE-2024-4439WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due…

    EPSS 71.0% chance of exploitation in 30 days, percentile 99%EPSS 71.0%WordPress
    2 y ago 2024-05-03
15. 5.3med
    CVE-2023-5692WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink

    WordPress
    2 y ago 2024-04-05
16. 5.5med
    CVE-2024-31211Remote Code Execution in `WP_HTML_Token`

    EPSS 2.7% chance of exploitation in 30 days, percentile 86%EPSS 2.7%WordPress
    2 y ago 2024-04-04
17. 7.7high
    CVE-2024-31210PHP file upload bypass via Plugin installer

    WordPress
    2 y ago 2024-04-04
18. 5.3med
    CVE-2023-5561WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure

    EPSS 4.3% chance of exploitation in 30 days, percentile 91%EPSS 4.3%WordPress
    3 y ago 2023-10-16
19. 4.3med
    CVE-2023-39999WordPress < 6.3.2 is vulnerable to Broken Access Control

    EPSS 1.2% chance of exploitation in 30 days, percentile 68%EPSS 1.2%WordPress
    3 y ago 2023-10-13
20. 6.5med
    CVE-2023-38000Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block

    WordPress
    3 y ago 2023-10-13
21. 6.1med
    CVE-2023-2745WordPress Core < 6.2.1 - Directory Traversal

    1 exploitEPSS 79.7% chance of exploitation in 30 days, percentile 100%EPSS 79.7%WordPress
    3 y ago 2023-05-17
22. 5.3med
    CVE-2023-22622WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the s…

    EPSS 1.7% chance of exploitation in 30 days, percentile 78%EPSS 1.7%WordPress
    3 y ago 2023-01-05
23. 5.9med
    CVE-2022-3590WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding

    EPSS 3.4% chance of exploitation in 30 days, percentile 89%EPSS 3.4%WordPress
    3 y ago 2022-12-14
24. 5.3med
    CVE-2022-43504Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email add…

    EPSS 1.5% chance of exploitation in 30 days, percentile 74%EPSS 1.5%WordPress
    3 y ago 2022-12-05
25. 6.1med
    CVE-2022-43500Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scr…

    WordPress
    3 y ago 2022-12-05
26. 6.1med
    CVE-2022-43497Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary scr…

    EPSS 1.3% chance of exploitation in 30 days, percentile 70%EPSS 1.3%WordPress
    3 y ago 2022-12-05
27. 6.5med
    CVE-2011-1762A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts.

    WordPress
    4 y ago 2022-04-18
28. 8.0high
    CVE-2022-21662Stored XSS in WordPress

    EPSS 64.5% chance of exploitation in 30 days, percentile 99%EPSS 64.5%WordPress
    4 y ago 2022-01-06
29. 6.6med
    CVE-2022-21663Authenticated Object Injection in Multisites in WordPress

    EPSS 3.8% chance of exploitation in 30 days, percentile 90%EPSS 3.8%WordPress
    4 y ago 2022-01-06
30. 7.4high
    CVE-2022-21664SQL injection in WordPress

    EPSS 3.7% chance of exploitation in 30 days, percentile 90%EPSS 3.7%WordPress
    4 y ago 2022-01-06