WordPress known exploited vulnerabilities
CISA's Known Exploited Vulnerabilities catalog lists 6 WordPress vulnerabilities: 3 added in the last 365 days, 2 rated critical (CVSS 9 or higher), and 0 with known ransomware use. The most recent was added Sep 25, 2026.
RSS feed for WordPress exploited vulnerabilities · Search them on KEVWire · Ask your AI assistant
| Added to KEV | CVE | Vulnerability | CVSS | EPSS | Federal due date | Ransomware use |
|---|---|---|---|---|---|---|
| 2026-09-25 | CVE-2026-87902 | WordPress Core Remote File Inclusion Vulnerability | 8.1 (v3.1) | 95.8% | 2026-09-28 | Unknown |
| 2026-07-21 | CVE-2026-60137 | WordPress Core SQL Injection Vulnerability | 5.9 (v3.1) | 5.3% | 2026-08-04 | Unknown |
| 2026-07-21 | CVE-2026-63030 | WordPress Core Interpretation Conflict Vulnerability | 9.8 (v3.1) | 10.6% | 2026-07-24 | Unknown |
| 2021-11-03 | CVE-2019-9978 | WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability | 6.1 (v3.1) | 72.9% | 2022-05-03 | Unknown |
| 2021-11-03 | CVE-2020-11738 | WordPress Snap Creek Duplicator Plugin File Download Vulnerability | 7.5 (v3.0) | 97.8% | 2022-05-03 | Unknown |
| 2021-11-03 | CVE-2020-25213 | WordPress File Manager Plugin Remote Code Execution Vulnerability | 10 (v3.1) | 97.3% | 2022-05-03 | Unknown |