Skip to content
Wordpress Foundation Wordpress vulnerabilities
-
wordpress, wordpress core +1 more
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
CVE-2026-119977
In KEVPublic exploitFix available
8.1 High
-
wordpress foundation wordpress
WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
CVE-2026-114570
4.9 Medium
-
automattic wordpress
WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability
CVE-2026-66666
Fix available
6.9 Medium
-
wordpress core, wordpress +1 more
WordPress Core Remote File Inclusion Vulnerability
CVE-2026-87902
In KEVPublic exploitFix available
EPSS 95.8%
8.1 High
-
automattic wordpress
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-93485
Public exploitFix available
7.1 High
-
wordpress
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A m…
CVE-2026-65640
Public exploitFix available
8.8 High
-
wordpress
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escala…
CVE-2026-64638
Public exploitFix available
8.9 High
-
wordpress, wordpress core +1 more
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
CVE-2026-63030
In KEVPublic exploitFix available
EPSS 10.6%
9.8 Critical
-
wordpress, wordpress core +1 more
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
CVE-2026-60137
In KEVPublic exploitFix available
5.9 Medium
-
wordpress foundation wordpress
WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API
CVE-2026-3906
Fix available
4.3 Medium
-
wordpress
WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability
CVE-2025-58674
Fix available
5.9 Medium
-
wordpress
WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability
CVE-2025-58246
Fix available
4.3 Medium
-
wordpress
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts...
CVE-2025-54352
Public exploit
3.7 Low
-
wordpress
WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function
CVE-2022-4973
Fix available
4.9 Medium
-
automattic wordpress
WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability
CVE-2024-32111
Fix available
5.0 Medium
-
automattic wordpress
WordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerability
CVE-2024-31111
Fix available
6.5 Medium
-
wordpress foundation wordpress
WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API
CVE-2024-6307
Fix available
6.4 Medium
-
wordpress
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar...
CVE-2024-4439
Public exploitFix available
EPSS 71.0%
7.2 High
-
wordpress foundation wordpress
WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink
CVE-2023-5692
Fix available
5.3 Medium
-
wordpress
WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
CVE-2023-5561
Public exploitFix available
5.3 Medium
-
wordpress, fedoraproject fedora +1 more
WordPress < 6.3.2 is vulnerable to Broken Access Control
CVE-2023-39999
Fix available
4.3 Medium
-
gutenberg team gutenberg, wordpress +1 more
Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block
CVE-2023-38000
Fix available
6.5 Medium
-
wordpress
WordPress Core < 6.2.1 - Directory Traversal
CVE-2023-2745
Public exploitFix available
EPSS 79.7%
5.4 Medium
-
wordpress
WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding
CVE-2022-3590
Public exploitFix available
5.9 Medium
-
wordpress
Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote...
CVE-2022-43504
Fix available
5.3 Medium
-
wordpress
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote...
CVE-2022-43500
Fix available
6.1 Medium
-
wordpress
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote...
CVE-2022-43497
Fix available
6.1 Medium
-
wordpress
A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking...
CVE-2011-1762
Fix available
6.5 Medium
-
wordpress, debian linux +1 more
Specially crafted filenames in WordPress leading to XSS
CVE-2020-11026
Fix available
8.7 High
-
wordpress, debian linux +1 more
Unauthenticated disclosure of certain private posts in WordPress
CVE-2020-11028
Fix available
5.8 Medium
-
wordpress, debian linux +1 more
Cross-site scripting in stats method (object cache) in WordPress
CVE-2020-11029
Fix available
5.8 Medium
-
wordpress, debian linux +1 more
Cross-site scripting (XSS) in Search block in WordPress
CVE-2020-11030
Fix available
6.4 Medium
-
wordpress, debian linux +1 more
Authenticated cross-site scripting (XSS) in WordPress Customizer
CVE-2020-11025
Fix available
5.8 Medium
-
wordpress, debian linux +1 more
Password reset links invalidation issue in WordPress
CVE-2020-11027
Public exploitFix available
EPSS 13.6%
6.1 Medium
-
wordpress, debian linux +1 more
Stored cross-site scripting (XSS) in WordPress block editor
CVE-2019-16781
Fix available
5.8 Medium
-
wordpress, debian linux +1 more
Stored cross-site scripting (XSS) in WordPress block editor
CVE-2019-16780
Fix available
5.8 Medium