Product by Debian

Wordpress

109 known vulnerabilities in Wordpress (Debian), 2 of them actively exploited (CISA KEV).

109

Vulnerabilities

Actively exploited (KEV)

Used by ransomware

Critical

Vulnerabilities

Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

Vulnerabilities in Wordpress (Debian)

Critical	CVE-2026-87902	WordPress Core Remote File Inclusion Vulnerability In CISA KEValso in 2 other products	8.1	22.09.2026
Critical	CVE-2026-60137	WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query In CISA KEValso in 2 other products	5.9	17.07.2026
Critical	CVE-2018-20148	WordPress: security vulnerability also in 2 other products	9.8	14.12.2018
High	CVE-2026-65640	WordPress: Unrestricted Upload of File with Dangerous Type also in 2 other products	8.8	17.08.2026
Critical	CVE-2020-28032	WordPress: Deserialization of Untrusted Data also in 3 other products	9.8	31.10.2020
High	CVE-2019-8942	WordPress: Remote Code Execution also in 2 other products	8.8	20.02.2019
High	CVE-2018-12895	WordPress: Path Traversal also in 2 other products	8.8	26.06.2018
Critical	CVE-2017-5611	WordPress: SQL Injection also in 3 other products	9.8	30.01.2017
Critical	CVE-2020-28037	WordPress: Denial of Service also in 3 other products	9.8	31.10.2020
High	CVE-2024-4439	WordPress: Cross-Site Scripting (XSS) also in 2 other products	7.2	03.05.2024
High	CVE-2022-21661	SQL injection in WordPress also in 4 other products	8.0	06.01.2022
High	CVE-2022-21662	Stored XSS in WordPress also in 3 other products	8.0	06.01.2022
Critical	CVE-2019-17669	WordPress: Server-Side Request Forgery (SSRF) also in 2 other products	9.8	17.10.2019
Critical	CVE-2020-28036	WordPress: Privilege Escalation also in 3 other products	9.8	31.10.2020
Critical	CVE-2019-20041	WordPress: security vulnerability also in 2 other products	9.8	27.12.2019
Critical	CVE-2019-17670	WordPress: Server-Side Request Forgery (SSRF) also in 2 other products	9.8	17.10.2019
Critical	CVE-2020-28035	WordPress: Privilege Escalation also in 3 other products	9.8	31.10.2020
High	CVE-2021-29447	WordPress Authenticated XXE attack when installation is running PHP 8 also in 3 other products	7.1	15.04.2021
Critical	CVE-2020-28039	WordPress: security vulnerability also in 3 other products	9.1	31.10.2020
Medium	CVE-2023-2745	WordPress Core < 6.2.1 - Directory Traversal also in 2 other products	5.4	17.05.2023
High	CVE-2016-4029	WordPress: Server-Side Request Forgery (SSRF) also in 2 other products	8.6	07.08.2016
High	CVE-2017-9066	WordPress: Server-Side Request Forgery (SSRF) also in 2 other products	8.6	18.05.2017
High	CVE-2018-20151	WordPress: security vulnerability also in 2 other products	7.5	14.12.2018
High	CVE-2020-11027	Password reset links invalidation issue in WordPress also in 2 other products	6.1	30.04.2020
Medium	CVE-2019-17671	WordPress: security vulnerability also in 2 other products	5.3	17.10.2019

All vulnerabilities in search

News

WordPress patches a critical severity security vulnerabilitycsoonline, 24.09.2026
NCSC-2026-0389 [1.01] [M/H] Kwetsbaarheid verholpen in WordPressncsc-nl, 24.09.2026
Critical WordPress Vulnerability Exploited Immediately After Disclosuresecurityweek, 24.09.2026
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosurethehackernews, 24.09.2026
Hackers start exploiting critical WordPress flaw for code executionbleepingcomputer, 23.09.2026
NCSC-2026-0389 [1.00] [M/H] Kwetsbaarheid verholpen in WordPressncsc-nl, 23.09.2026

All products by Debian

Key figures

Vulnerabilities

News