WordPress Foundation
Vulnerability activity for WordPress Foundation: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Last 90 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Last 365 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
Recent
- 8.1HighOct 31, 2026WordPress Code / command injectionCVE-2026-119977WordPress Core versions 4.7 through 7.1.3. An attacker gains Remote Code Execution (RCE) on the server. Upgrade to WordPress Core version 7.1.4 or later.Exploited1% likelyExploit code
- 4.9MediumOct 22, 2026WordPress XSSCVE-2026-114570WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
Top products
- WordPress2 CVEs in the last year, 1 exploited
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CCCS (Canada) · Nov 3, 2026WordPress security advisory (AV26-1117)CVE-2026-119977
- CISA · Nov 3, 2026CISA Adds One Known Exploited Vulnerability to CatalogCVE-2026-119977
- EUVD exploited · Oct 31, 2026EUVD-2026-114575 · WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to…CVE-2026-119977
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.