WordPress

Vulnerability activity for WordPress: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 1
Critical (CVSS 9+): 0
Exploited (CISA KEV): 1
With exploit code: 1

Last 365 days

CVEs: 3
Critical (CVSS 9+): 1
Exploited (CISA KEV): 3
With exploit code: 3

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

8.1HighSep 25, 2026WordPress Core Path traversal / file handlingCVE-2026-87902WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.Added to KEV Sep 25, 2026Exploited40% likelyExploit codeExploit-DB · NucleiDetection
9.8CriticalJul 21, 2026WordPress CoreCVE-2026-63030WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.Added to KEV Jul 21, 2026Exploited11% likelyExploit codeMetasploit · NucleiDetection
5.9MediumJul 21, 2026WordPress Core SQL injectionCVE-2026-60137WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.Added to KEV Jul 21, 2026Exploited5.3% likelyExploit codeMetasploitDetection
6.1MediumMar 24, 2019WordPress Social Warfare Plugin XSSCVE-2019-9978WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.Added to KEV Nov 3, 2021 · 954 days after publicationExploited73% likelyExploit codeExploit-DB · NucleiDetection
7.5HighApr 13, 2020WordPress Snap Creek Duplicator Plugin Path traversal / file handlingCVE-2020-11738WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.Added to KEV Nov 3, 2021 · 568 days after publicationExploited98% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
10.0CriticalSep 9, 2020WordPress File Manager Plugin Path traversal / file handlingCVE-2020-25213WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.Added to KEV Nov 3, 2021 · 420 days after publicationExploited97% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

Recent

8.1HighSep 25, 2026WordPress Core Path traversal / file handlingCVE-2026-87902WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.Exploited40% likelyExploit codeExploit-DB · NucleiDetection
5.9MediumJul 21, 2026WordPress Core SQL injectionCVE-2026-60137WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.Exploited5.3% likelyExploit codeMetasploitDetection
9.8CriticalJul 21, 2026WordPress CoreCVE-2026-63030WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.Exploited11% likelyExploit codeMetasploit · NucleiDetection
10.0CriticalSep 9, 2020WordPress File Manager Plugin Path traversal / file handlingCVE-2020-25213WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.Exploited97% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
7.5HighApr 13, 2020WordPress Snap Creek Duplicator Plugin Path traversal / file handlingCVE-2020-11738WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.Exploited98% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
6.1MediumMar 24, 2019WordPress Social Warfare Plugin XSSCVE-2019-9978WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.Exploited73% likelyExploit codeExploit-DB · NucleiDetection

See every WordPress entry on the dashboard.