Wordpress vulnerabilities

CVEs per yearBy the year they were published

1. 20192
2. 202011
3. 20217
4. 20225
5. 20231
6. 20242
7. 20253
8. 20268

Known exploitedNewest addition to KEV first

• CVE-2026-87902

  An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme…

  WordPress · WordPress

  ExploitedHigh8.1
• CVE-2026-63030

  WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

  WordPress · WordPress

  ExploitedCritical9.8
• CVE-2026-60137

  WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

  WordPress · WordPress

  ExploitedMedium5.9

Newest CVEs

• CVE-2026-87902

  An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme…

  WordPress · WordPress

  ExploitedHigh8.1
• CVE-2026-65640

  WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: *…

  WordPress · WordPress

  High8.8
• CVE-2026-64638

  WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an…

  WordPress · WordPress

  High8.9
• CVE-2026-45293

  WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability

  WordPress · WordPress-Coding-Standards

  High8.6
• CVE-2026-63030

  WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

  WordPress · WordPress

  ExploitedCritical9.8
• CVE-2026-60137

  WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

  WordPress · WordPress

  ExploitedMedium5.9
• CVE-2020-37233

  WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting

  Wordpress · Buddypress

  Medium5.1
• CVE-2023-54333

  Social-Share-Buttons 2.2.3 - SQL Injection via project_id Parameter

  Wordpress · Social-Share-Buttons

  High8.8
• CVE-2025-58674

  WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability

  WordPress · WordPress

  Medium5.9
• CVE-2025-58246

  WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability

  WordPress · WordPress

  Medium4.3