WO
CMS
WordPress
On CISA KEVExploited in the wild
365
CVEs
7
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 20High 47Medium 103Low 2
Watch
Add WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-63030 In wildKEV | 9.8 | Jul 17 | WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution Affected: 6.9.0 before 6.9.5; 7.0.0 before 7.0.2 |
| CVE-2020-25213 In wildKEV | 9.8 | Sep 9 | WordPress File Manager Plugin Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2016-10033 In wildKEV | 9.8 | Dec 30 | The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute… Affected: through 4.7 |
| CVE-2026-87902 In wildKEV | 8.1 | Sep 22 | WordPress Core Remote File Inclusion Vulnerability Affected: before 7.1.2 |
| CVE-2020-11738 In wildKEV | 7.5 | Apr 13 | WordPress Snap Creek Duplicator Plugin File Download Vulnerability Affected: All versions, or not specified |
| CVE-2019-9978 In wildKEV | 6.1 | Mar 24 | WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability Affected: All versions, or not specified |
| CVE-2026-60137 In wildKEV | 5.9 | Jul 17 | WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query Affected: 6.8.0 before 6.8.6; 6.9.0 before 6.9.5; 7.0.0 before 7.0.2 |
Showing 7