WordPress WordPress
18 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-87902 | < 7.1.2 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the | HIGH 8.1 | 96 % | KEV | |
| CVE-2026-65640 | < 7.0.4 | WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Pr | HIGH 8.8 | 1.9 % | ||
| CVE-2026-64638 | | WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party webs | HIGH 8.9 | 0.9 % | ||
| CVE-2026-63030 | 6.9.0 – < 6.9.5 ; 7.0.0 – < 7.0.2 | WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution | CRITICAL 9.8 | 11 % | KEV | |
| CVE-2026-60137 | 6.8.0 – < 6.8.6 ; 6.9.0 – < 6.9.5 ; 7.0.0 – < 7.0.2 | WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query | MEDIUM 5.9 | 5.3 % | KEV | |
| CVE-2025-58674 | 6.8 – 6.8.2 ; 6.7 – 6.7.3 ; 6.6 – 6.6.3 ; … | WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability | MEDIUM 5.9 | 0.2 % | ||
| CVE-2025-58246 | 6.8 – 6.8.2 ; 6.7 – 6.7.3 ; 6.6 – 6.6.3 ; … | WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-54352 | 3.5 – 6.8.2 | WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the | LOW 3.7 | 0.4 % | ||
| CVE-2023-5561 | 6.3.0 – < 6.3.2 ; 6.2.0 – < 6.2.3 ; 6.1.0 – < 6.1.4 ; … | WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure | MEDIUM 5.3 | 4.3 % | ||
| CVE-2022-3590 | 4.1.30 – 6.1.1 | WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding | MEDIUM 5.9 | 3.4 % | ||
| CVE-2020-11026 | >= 5.4.0, < 5.4.1 ; >= 5.3.0, < 5.3.3 ; >= 5.2.0, < 5.2.6 ; … | Specially crafted filenames in WordPress leading to XSS | HIGH 8.7 | 2.1 % | ||
| CVE-2020-11028 | >= 5.4.0, < 5.4.1 ; >= 5.3.0, < 5.3.3 ; >= 5.2.0, < 5.2.6 ; … | Unauthenticated disclosure of certain private posts in WordPress | HIGH 7.5 | 2.3 % | ||
| CVE-2020-11029 | >= 5.4.0, < 5.4.1 ; >= 5.3.0, < 5.3.3 ; >= 5.2.0, < 5.2.6 ; … | Cross-site scripting in stats method (object cache) in WordPress | MEDIUM 6.1 | 2.1 % | ||
| CVE-2020-11030 | >= 5.4.0, < 5.4.1 ; >= 5.3.0, < 5.3.3 ; >= 5.2.0, < 5.2.6 ; … | Cross-site scripting (XSS) in Search block in WordPress | MEDIUM 6.4 | 1.4 % | ||
| CVE-2020-11025 | >= 5.4.0, < 5.4.1 ; >= 5.3.0, < 5.3.3 ; >= 5.2.0, < 5.2.6 ; … | Authenticated cross-site scripting (XSS) in WordPress Customizer | MEDIUM 5.8 | 1.5 % | ||
| CVE-2020-11027 | >= 5.4.0, < 5.4.1 ; >= 5.3.0, < 5.3.3 ; >= 5.2.0, < 5.2.6 ; … | Password reset links invalidation issue in WordPress | HIGH 8.1 | 14 % | ||
| CVE-2019-16781 | < 5.3.1 – < 5.3.1 | Stored cross-site scripting (XSS) in WordPress block editor | MEDIUM 5.8 | 1.6 % | ||
| CVE-2019-16780 | < 5.3.1 – < 5.3.1 | Stored cross-site scripting (XSS) in WordPress block editor | MEDIUM 5.8 | 1.7 % |