WordPress WordPress vulnerabilities

CVEs per yearBy the year they were published

1. 20192
2. 20206
3. 20221
4. 20231
5. 20253
6. 20265

Known exploitedNewest addition to KEV first

• CVE-2026-87902

  An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme…

  WordPress · WordPress

  ExploitedHigh8.1
• CVE-2026-63030

  WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

  WordPress · WordPress

  ExploitedCritical9.8
• CVE-2026-60137

  WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

  WordPress · WordPress

  ExploitedMedium5.9

Newest CVEs

• CVE-2026-87902

  An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme…

  WordPress · WordPress

  ExploitedHigh8.1
• CVE-2026-65640

  WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: *…

  WordPress · WordPress

  High8.8
• CVE-2026-64638

  WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an…

  WordPress · WordPress

  High8.9
• CVE-2026-63030

  WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

  WordPress · WordPress

  ExploitedCritical9.8
• CVE-2026-60137

  WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

  WordPress · WordPress

  ExploitedMedium5.9
• CVE-2025-58674

  WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability

  WordPress · WordPress

  Medium5.9
• CVE-2025-58246

  WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability

  WordPress · WordPress

  Medium4.3
• CVE-2025-54352

  WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not…

  WordPress · WordPress

  Low3.7
• CVE-2023-5561

  WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure

  WordPress · WordPress

  Medium5.3
• CVE-2022-3590

  WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding

  WordPress · WordPress

  Medium5.9