Product by Open Source
Wordpress
7 known vulnerabilities in Wordpress (Open Source), 3 of them actively exploited (CISA KEV).
Key figures
7
Vulnerabilities
3
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-87902 | WordPress Core Remote File Inclusion Vulnerability In CISA KEValso in 2 other products | 8.1 | |
| Critical | CVE-2026-63030 | WordPress Core Interpretation Conflict Vulnerability In CISA KEValso in 1 other product | 9.8 | |
| Critical | CVE-2026-60137 | WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query In CISA KEValso in 2 other products | 5.9 | |
| High | CVE-2026-65640 | WordPress: Unrestricted Upload of File with Dangerous Type | 8.8 | |
| High | CVE-2026-64638 | WordPress: Cross-site Scripting | — | |
| Medium | CVE-2026-66666 | Automattic WordPress: Insertion of Sensitive Information Into Sent Data | — | |
| High | CVE-2026-93485 | WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability | 7.1 |
News
- WordPress patches a critical severity security vulnerabilitycsoonline,
- NCSC-2026-0389 [1.01] [M/H] Kwetsbaarheid verholpen in WordPressncsc-nl,
- Critical WordPress Vulnerability Exploited Immediately After Disclosuresecurityweek,
- Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosurethehackernews,
- Hackers start exploiting critical WordPress flaw for code executionbleepingcomputer,
- NCSC-2026-0389 [1.00] [M/H] Kwetsbaarheid verholpen in WordPressncsc-nl,