WordPress Foundation vulnerabilities

8 published CVEs name WordPress Foundation among the affected products; CISA lists 1 of them as exploited in the wild.

Critical 0High 2Medium 6Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2026-119977
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
WordPress Foundation · WordPress
ExploitedHigh8.1

CVE-2026-119977
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
WordPress Foundation · WordPress
ExploitedHigh8.1
CVE-2026-114570
WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
WordPress Foundation · WordPress
Medium4.9
CVE-2026-3906
WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API
WordPress Foundation · WordPress
Medium4.3
CVE-2022-4973
WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function
WordPress Foundation · WordPress
Medium4.9
CVE-2024-6307
WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API
WordPress Foundation · WordPress
Medium6.4
CVE-2024-4439
WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient…
WordPress Foundation · WordPress
High7.2
CVE-2023-5692
WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink
WordPress Foundation · WordPress
Medium5.3
CVE-2023-2745
WordPress Core < 6.2.1 - Directory Traversal
WordPress Foundation · WordPress
Medium5.4