Wordpress vulnerabilities
39 published CVEs name Wordpress among the affected products; CISA lists 3 of them as exploited in the wild.
- 39Published CVEs39 of them scored
- 8Last 12 monthspublished in the last year
- 2Critical13 more rated high
- 3Known exploitedin CISA's KEV catalog
Known exploited
Newest addition to KEV first.
- CVE-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme…
WordPress · WordPress
ExploitedHigh8.1 - CVE-2026-63030
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
WordPress · WordPress
ExploitedCritical9.8 - CVE-2026-60137
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
WordPress · WordPress
ExploitedMedium5.9