[ Vendor · 7 CVEs ]
WordPress
CVEs affecting WordPress published in the last 30 days, plus any WordPress CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-87902 | 22 Sep 2026 | CVSS 8.1 | Local file inclusion in WordPress core can lead to code executionAn unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active… | ExploitedFix |
| CVE-2026-63030 | 17 Jul 2026 | CVSS 9.8 | WordPress Core Interpretation ConflictWordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the… | Exploited |
| CVE-2026-60137 | 17 Jul 2026 | CVSS 5.9 | WordPress Core SQL InjectionWordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which… | Exploited |
| CVE-2020-25213 | 9 Sep 2020 | CVSS 9.8 | WordPress File Manager Plugin Remote Code ExecutionThe File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitrary PHP code because it… | ExploitedFix |
| CVE-2020-11738 | 13 Apr 2020 | CVSS 7.5 | WordPress Snap Creek Duplicator Plugin File DownloadThe Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file… | Exploited |
| CVE-2019-9978 | 24 Mar 2019 | CVSS 6.1 | WordPress Social Warfare Plugin Cross-Site Scripting (XSS)The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as… | Exploited |
| CVE-2016-10033 | 30 Dec 2016 | CVSS 9.8 | PHPMailer Command InjectionThe mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command… | ExploitedFix |