Skip to content
BackEsc
Sign in

WordPress · product

WordPress

73 CVEs · 4 exploited

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

exploited in the wild
4
check available
7
likely to be exploited
9

Every one of the 73 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. WordPress Core - PHP Template Path TraversalCVE-2026-87902WordPress · CVSS 8.1 · 96% likelycovered by CyberSIXT

    CWE-9810 articles

  2. WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route ConfusionCVE-2026-63030WordPress · CVSS 9.8 · 11% likelycovered by CyberSIXT

    CWE-436CyberXeroRed Heron4 articles1 article this week: SOCRadar profiles CyberXero’s AI-assisted attacks on Ukraine

  3. WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_QueryCVE-2026-60137WordPress · CVSS 5.9 · 5.3% likelycovered by CyberSIXT

    CWE-89CyberXeroRed Heron3 articles1 article this week: SOCRadar profiles CyberXero’s AI-assisted attacks on Ukraine

  4. WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code ExecutionCVE-2026-119977WordPress Foundation · CVSS 8.1 · 1.2% likelycovered by CyberSIXT

    CWE-3674 articles

  5. WordPress Core 5.0.0 - Crop-image Shell UploadCVE-2019-8943Wordpress · 92% likely

    CWE-22

  6. WordPress Core <=6.2 - Directory TraversalCVE-2023-2745WordPress Foundation · CVSS 5.4 · 80% likely

    CWE-22

  7. WordPress Core <6.5.2 - Cross-Site ScriptingCVE-2024-4439WordPress Foundation · CVSS 7.2 · 71% likely

    CWE-79

  8. WordPress <= 5.2.4 - Unauthenticated View Private/Draft PostsCVE-2019-17671Wordpress · 37% likely

    CWE-200

  9. WordPress Core - Post Author Email DisclosureCVE-2023-5561WordPress · CVSS 5.3 · 4.3% likely

    CWE-200

  10. WordPress <= 6.2 - Server Side Request ForgeryCVE-2022-3590WordPress · CVSS 5.9 · 3.4% likely

    CWE-918

  11. WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)CVE-2026-64638WordPress · CVSS 8.9 · 0.9% likelycovered by CyberSIXT

    CWE-79

  12. WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending wit…CVE-2019-8942Wordpress · 83% likely

    CWE-434

  13. In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script…CVE-2018-6389Wordpress · 73% likely

    CWE-400

  14. WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink…CVE-2018-12895Wordpress · 62% likely

    CWE-22

  15. WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF pro…CVE-2019-9787Wordpress · 39% likely

    CWE-352

  16. WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPres…CVE-2021-44223Wordpress · CVSS 8.1 · 29% likely
  17. In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mi…CVE-2018-20148Wordpress · 27% likely

    CWE-502

  18. WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.CVE-2020-28032Wordpress · 16% likely

    CWE-502

  19. In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extr…CVE-2018-14028Wordpress · 15% likely

    CWE-434

  20. Password reset links invalidation issue in WordPressCVE-2020-11027WordPress · CVSS 6.1 · 14% likely

    CWE-672

  21. WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an incomplete fix for…CVE-2018-1000773Wordpress · 8.2% likely

    CWE-20

  22. is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a n…CVE-2020-28037Wordpress · 8.1% likely

    CWE-754

  23. In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine…CVE-2018-20151Wordpress · 5.8% likely

    CWE-200

  24. WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.CVE-2019-17669Wordpress · 5.2% likely

    CWE-918

  25. wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.CVE-2020-28036Wordpress · 5.2% likely

    CWE-862

  26. WordPress before 5.2.3 allows XSS in post previews by authenticated users.CVE-2019-16223Wordpress · 5.2% likely

    CWE-79

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in