Skip to content
Sign in

WordPress product

Several products

Alert
No Several products CVE is in the CISA KEV catalogue.

Tracked since 7 Aug · latest article 28 Sep · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 0 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

0Articles · 7 days

none this week

Exploited, by due date

No Several products CVE is in the CISA KEV catalogue.

Patch cadence and exploit odds

How often CISA adds Several products CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

CISA has not added a Several products CVE to KEV.

Fix listed

2 of 3 CVEs in coverage

1 CVE has no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2026-87902: 99.9th percentile, in CISA KEVCVE-2026-65640: 80th percentileCVE-2026-64638: 59.4th percentile050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2026-8790299.9
CVE-2026-6564080
CVE-2026-6463859.4

Coverage13 articles · all time

The latest 13 articles naming Several products, in the shared story grammar.

Full timeline
Quiet for 5 weekslast report 28 Sep13 articles6 outlets

13 articles from 6 outlets since 7 Aug. Quiet since 28 Sep.

Now7 Aug10121422 Sep252729First reportSecurityOnline · 7 Aug, 03:41CISA alert25 Sep, 20:01 · officialExploited CVESecurityOnline · 22 Sep
  • Fri 7 Aug, 03:41 UTC. SecurityOnline, first report. CVE-2026-64638: WordPress Pre-Auth XSS Flaw Can Escalate to Remote Code Execution.
  • Thu 13 Aug, 09:58 UTC. SecurityOnline. WordPress flaw CVE-2026-65640 lets authors run code remotely.
  • Thu 13 Aug, 13:21 UTC. SecurityWeek, its first report on the story. WordPress patches CVE-2026-65640 after remote code flaw found.
  • Tue 22 Sep, 18:01 UTC. SecurityOnline. WordPress Fixes High Risk Path Traversal Flaw Enabling Code Execution. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 08:47 UTC. Security Affairs, its first report on the story. WordPress Patches Critical Flaw Enabling Conditional Code Execution. Cites a CVE in CISA KEV.
  • Wed 23 Sep, 17:38 UTC. SecurityOnline. WordPress RCE Flaw Exploited in the Wild as PoC Goes Public. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 07:36 UTC. SecurityWeek. WordPress Flaw Exploited Within Hours to Gain Remote Code Execution. Cites a CVE in CISA KEV.
  • Thu 24 Sep, 08:47 UTC. The Hacker News, its first report on the story. Attackers Exploit Critical WordPress Flaw Hours After Disclosure. Cites a CVE in CISA KEV.
  • Fri 25 Sep, 20:01 UTC. CISA, its first report on the story. CISA Warns of Actively Exploited WordPress Flaw Enabling Code Execution. Cites a CVE in CISA KEV.
  • Sat 26 Sep, 08:26 UTC. Security Affairs. CISA Warns of Actively Exploited WordPress Flaw Enabling RCE. Cites a CVE in CISA KEV.
  • Sun 27 Sep, 14:30 UTC. Security Affairs. OpenAI Agents Bypassed Controls on US and Australian Government Sites. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 02:30 UTC. SecurityOnline. Nine Flaws Exploited as Attackers Target Edge Products and WordPress. Cites a CVE in CISA KEV.
  • Mon 28 Sep, 14:30 UTC. Check Point, its first report on the story. Check Point Warns of Active Exploits and AI-Powered Attacks. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 13 articles as a list
  1. Fri 7 AugDay 01
    1. CVE-2026-64638: WordPress Pre-Auth XSS Flaw Can Escalate to Remote Code Execution03:41 · SecurityOnline · First report

  2. Quiet for 6 days

    Thu 13 AugDay 62
    1. WordPress flaw CVE-2026-65640 lets authors run code remotely09:58 · SecurityOnline · Picked up again
    2. WordPress patches CVE-2026-65640 after remote code flaw found13:21 · SecurityWeek

  3. Quiet for 6 weeks

    Tue 22 SepDay 461
    1. WordPress Fixes High Risk Path Traversal Flaw Enabling Code Execution18:01 · SecurityOnline · Exploited CVE · Picked up again · Known exploited CVE
  4. Wed 23 SepDay 472
    1. WordPress Patches Critical Flaw Enabling Conditional Code Execution08:47 · Security Affairs · Known exploited CVE
    2. WordPress RCE Flaw Exploited in the Wild as PoC Goes Public17:38 · SecurityOnline · Known exploited CVE
  5. Thu 24 SepDay 482
    1. WordPress Flaw Exploited Within Hours to Gain Remote Code Execution07:36 · SecurityWeek · Known exploited CVE
    2. Attackers Exploit Critical WordPress Flaw Hours After Disclosure08:47 · The Hacker News · Known exploited CVE
  6. Fri 25 SepDay 491
    1. CISA Warns of Actively Exploited WordPress Flaw Enabling Code Execution20:01 · CISA · official · CISA alert · Known exploited CVE
  7. Sat 26 SepDay 501
    1. CISA Warns of Actively Exploited WordPress Flaw Enabling RCE08:26 · Security Affairs · Known exploited CVE
  8. Sun 27 SepDay 511
    1. OpenAI Agents Bypassed Controls on US and Australian Government Sites14:30 · Security Affairs · Known exploited CVE
  9. Mon 28 SepDay 522
    1. Nine Flaws Exploited as Attackers Target Edge Products and WordPress02:30 · SecurityOnline · Known exploited CVE
    2. Check Point Warns of Active Exploits and AI-Powered Attacks14:30 · Check Point · Known exploited CVE

All CVEs in coverage3

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2026-87902Exploited

    WordPress Core Remote File Inclusion Vulnerability

    8.1High96% EPSS · 10 articles
  • CVE-2026-65640

    WordPress vulnerability

    8.8High1.9% EPSS · 2 articles
  • CVE-2026-64638

    WordPress vulnerability

    8.9High0.9% EPSS · 1 article
CyberSIXTSignal over noise
Updated AboutDevelopersSign in