What’s Vulnerable › Products

WordPress vulnerabilities

365 known vulnerabilities, 4 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your WordPress version is affected

Exploited WordPress vulnerabilities

• CVE-2026-87902 — WordPress Core Remote File Inclusion Vulnerability
• CVE-2026-63030 — WordPress Core Interpretation Conflict Vulnerability
• CVE-2026-60137 — WordPress Core SQL Injection Vulnerability
• CVE-2016-10033 — PHPMailer Command Injection Vulnerability

Latest WordPress vulnerabilities

• CVE-2026-114570 — WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit (CVSS 4.9)
• CVE-2026-87902 — WordPress Core Remote File Inclusion Vulnerability (CVSS 8.1) — exploited
• CVE-2026-65640 — (CVSS 8.8)
• CVE-2026-64638 — (CVSS 8.9)
• CVE-2026-63030 — WordPress Core Interpretation Conflict Vulnerability (CVSS 9.8) — exploited
• CVE-2026-60137 — WordPress Core SQL Injection Vulnerability (CVSS 5.9) — exploited
• CVE-2026-3906 — WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API (CVSS 4.3)
• CVE-2025-58674 — WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
• CVE-2025-58246 — WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability (CVSS 4.3)
• CVE-2025-54352 — (CVSS 3.7)
• CVE-2022-4973 — WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function (CVSS 5.4)
• CVE-2024-6307 — WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API (CVSS 6.4)
• CVE-2024-4439 — (CVSS 6.1)
• CVE-2023-5692 — WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink (CVSS 5.3)
• CVE-2024-31211 — Remote Code Execution in `WP_HTML_Token` (CVSS 9.8)
• CVE-2024-31210 — PHP file upload bypass via Plugin installer (CVSS 8.8)
• CVE-2023-5561 — WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure (CVSS 5.3)
• CVE-2023-39999 — WordPress < 6.3.2 is vulnerable to Broken Access Control (CVSS 4.3)
• CVE-2023-38000 — Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block (CVSS 5.4)
• CVE-2023-2745 — WordPress Core < 6.2.1 - Directory Traversal (CVSS 5.4)
• CVE-2023-22622 — (CVSS 5.3)
• CVE-2022-3590 — WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding (CVSS 5.9)
• CVE-2022-43504 — (CVSS 5.3)
• CVE-2022-43500 — (CVSS 6.1)
• CVE-2022-43497 — (CVSS 6.1)