CVE Tools
Track your stack

WordPress

365 CVEs tracked. 5 of them are in CISA KEV.

This hub aggregates every CVE we track for WordPress, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

WordPress CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
WordPress CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-071
2025-080
2025-092
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-072
2026-082
2026-091
2026-101
2026-110

Severity

How the 365 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical288%
  • High7621%
  • Medium24166%
  • Low195%

Latest CVEs

The 15 most recently published vulnerabilities affecting WordPress.

  1. CVE-2026-119977WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution8.1
  2. CVE-2026-87902An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for ...8.1
  3. CVE-2026-65640WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the serv...8.8
  4. CVE-2026-64638WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be ...—
  5. CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution9.8
  6. CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query5.9
  7. CVE-2025-58674WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability5.9
  8. CVE-2025-58246WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability4.3
  9. CVE-2025-54352WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.3.7
  10. CVE-2022-4973WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function4.9
  11. CVE-2024-4439WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This ...7.2
  12. CVE-2024-31211Remote Code Execution in `WP_HTML_Token`5.5
  13. CVE-2024-31210PHP file upload bypass via Plugin installer7.6
  14. CVE-2023-5561WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure5.3
  15. CVE-2023-39999WordPress < 6.3.2 is vulnerable to Broken Access Control4.3

Product grouping is registry-driven, with AI assist and human review. How it works