Automattic WordPress vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20262

Newest CVEs

• CVE-2026-66666

  WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability

  Automattic · WordPress

  Medium6.9
• CVE-2026-93485

  WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability

  Automattic · WordPress

  High7.1
• CVE-2024-32111

  WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability

  Automattic · WordPress

  Medium5.0
• CVE-2024-31111

  WordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerability

  Automattic · WordPress

  Medium6.5