Skip to content
Sign in

WordPress product

Core

Alert
No CISA KEV deadline is open. CISA last added a Core CVE on 25 Sep.

Tracked since 17 Jul · latest article 23 Oct · RSS · API

0Open KEV deadlines

None open

1Added to KEV · 90 days

of 3 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date3

Core CVEs in CISA KEV with their federal deadlines. None is open.

Exploited Core CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2026-87902Core25 SepPassed 28 Sep10
In CISA KEVCVE-2026-63030Core21 JulPassed 24 Jul15
In CISA KEVCVE-2026-60137Core21 JulPassed 4 Aug11
Vendor CSV of 6 entries for WordPressAll 6 vendor entries, including other products.

Patch cadence and exploit odds

How often CISA adds Core CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’250Q1 ’260Q2 ’263Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20260
Q3 20263
Q4 20260

Fix listed

2 of 2 CVEs in coverage

Every CVE in coverage has a fix recorded.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-63030: 95.8th percentile, in CISA KEVCVE-2026-60137: 92.6th percentile, in CISA KEV050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-6303095.8
CVE-2026-6013792.6

Coverage16 articles · all time

The latest 16 articles naming Core, in the shared story grammar.

Full timeline
Quiet for 8 dayslast report 23 Oct16 articles9 outlets

16 articles from 9 outlets since 17 Jul. Quiet since 23 Oct.

Now17 Jul2521 Sep2725811151923First reportRapid7 · 17 Jul, 23:51CISA alert21 Jul, 15:28 · official
  • Fri 17 Jul, 23:51 UTC. Rapid7, first report. WordPress REST API flaw lets attackers run code remotely. Cites a CVE in CISA KEV.
  • Sat 18 Jul, 02:41 UTC. SecurityOnline, its first report on the story. WordPress SQLi bug allows remote code execution, update now. Cites a CVE in CISA KEV.
  • Sun 19 Jul, 05:51 UTC. Security Affairs, its first report on the story. Public PoC exploits hit critical WordPress CVEs, urging patches. Cites a CVE in CISA KEV.
  • Mon 20 Jul, 05:50 UTC. SecurityWeek, its first report on the story. WordPress flaws CVE-2026-60137 and CVE-2026-63030 allow RCE. Cites a CVE in CISA KEV.
  • Mon 20 Jul, 14:10 UTC. Infosecurity, its first report on the story. AI crafted WordPress exploit chain triggers urgent CVE patches. Cites a CVE in CISA KEV.
  • Mon 20 Jul, 21:21 UTC. SANS ISC, its first report on the story. WordPress core flaw CVE-2026-63030 lets attackers execute code. Cites a CVE in CISA KEV.
  • Mon 20 Jul, 22:01 UTC. Dark Reading, its first report on the story. 'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover. Cites a CVE in CISA KEV.
  • Tue 21 Jul, 03:32 UTC. SecurityOnline. Critical WordPress Bug Lets Attackers Run Code Remotely. Cites a CVE in CISA KEV.
  • Tue 21 Jul, 15:28 UTC. CISA, its first report on the story. CISA flags critical WordPress SQLi flaw in KEV, urges patch. Cites a CVE in CISA KEV.
  • Tue 21 Jul, 15:30 UTC. CISA. CISA Warns of Critical WordPress Flaw CVE‑2026-63030 in KEV. Cites a CVE in CISA KEV.
  • Tue 21 Jul, 18:11 UTC. SecurityOnline. CISA warns of active exploits in WordPress, Langflow, DDWRT. Cites a CVE in CISA KEV.
  • Wed 22 Jul, 11:40 UTC. Security Affairs. CISA adds DDWRT, Langflow and WordPress bugs to KEV list. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 02:21 UTC. SecurityOnline. UK firms must patch now as CISA flags six active exploits. Cites a CVE in CISA KEV.
  • Tue 22 Sep, 04:23 UTC. SecurityOnline. Suspected Chinese Actor Exposed 18,566 Government Records in Campaign. Cites a CVE in CISA KEV.
  • Mon 12 Oct, 08:01 UTC. The Hacker News, its first report on the story. AI Powered Campaign Breaches Ukrainian Infrastructure and 429 WordPress Sites. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 18:36 UTC. The Hacker News. AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 16 articles as a list
  1. Fri 17 JulDay 01
    1. WordPress REST API flaw lets attackers run code remotely23:51 · Rapid7 · First report · Exploited CVE · Known exploited CVE
  2. Sat 18 JulDay 11
    1. WordPress SQLi bug allows remote code execution, update now02:41 · SecurityOnline · Known exploited CVE
  3. Sun 19 JulDay 21
    1. Public PoC exploits hit critical WordPress CVEs, urging patches05:51 · Security Affairs · Known exploited CVE
  4. Mon 20 JulDay 34
    1. WordPress flaws CVE-2026-60137 and CVE-2026-63030 allow RCE05:50 · SecurityWeek · Known exploited CVE
    2. AI crafted WordPress exploit chain triggers urgent CVE patches14:10 · Infosecurity · Known exploited CVE
    3. WordPress core flaw CVE-2026-63030 lets attackers execute code21:21 · SANS ISC · Known exploited CVE
    4. 'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover22:01 · Dark Reading · Known exploited CVE
  5. Tue 21 JulDay 44
    1. Critical WordPress Bug Lets Attackers Run Code Remotely03:32 · SecurityOnline · Known exploited CVE
    2. CISA flags critical WordPress SQLi flaw in KEV, urges patch15:28 · CISA · official · CISA alert · Known exploited CVE
    3. CISA Warns of Critical WordPress Flaw CVE‑2026-63030 in KEV15:30 · CISA · official · Known exploited CVE
    4. CISA warns of active exploits in WordPress, Langflow, DDWRT18:11 · SecurityOnline · Known exploited CVE
  6. Wed 22 JulDay 51
    1. CISA adds DDWRT, Langflow and WordPress bugs to KEV list11:40 · Security Affairs · Known exploited CVE

  7. Quiet for 5 days

    Mon 27 JulDay 101
    1. UK firms must patch now as CISA flags six active exploits02:21 · SecurityOnline · Picked up again · Known exploited CVE

  8. Quiet for 8 weeks

    Tue 22 SepDay 671
    1. Suspected Chinese Actor Exposed 18,566 Government Records in Campaign04:23 · SecurityOnline · Picked up again · Known exploited CVE

  9. Quiet for 3 weeks

    Mon 12 OctDay 871
    1. AI Powered Campaign Breaches Ukrainian Infrastructure and 429 WordPress Sites08:01 · The Hacker News · Picked up again · Known exploited CVE

  10. Quiet for 11 days

    Fri 23 OctDay 981
    1. AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices18:36 · The Hacker News · Picked up again · Known exploited CVE

All CVEs in coverage2

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-63030Exploited

    WordPress Core Interpretation Conflict Vulnerability

    9.8Critical11% EPSS · 15 articles
  • CVE-2026-60137Exploited

    WordPress Core SQL Injection Vulnerability

    9.1Critical5.3% EPSS · 11 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in