Vendor

    WP Engine

    20 known vulnerabilities in products by WP Engine, 0 of them actively exploited (CISA KEV).

    Key figures

    20

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in WP Engine
    HighCVE-2023-6933

    Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection

    		8.8
    CriticalCVE-2019-9879

    Wpengine Wpgraphql: security vulnerability

    		9.8
    CriticalCVE-2019-9880

    Wpengine Wpgraphql: security vulnerability

    		9.1
    MediumCVE-2019-9881

    Wpengine Wpgraphql: security vulnerability

    		5.3
    HighCVE-2026-54239

    FaustWP — Authentication Bypass via Initialization Vector Modification in Token Envelope

    		8.8
    MediumCVE-2026-4812

    Wpengine Advanced Custom Fields (ACF®): Missing Authorization

    		5.3
    HighCVE-2026-4030

    Wpengine Database Backup for WordPress: Missing Authorization

    		8.1
    HighCVE-2026-4031

    Wpengine Database Backup for WordPress: Missing Authorization

    		7.5
    HighCVE-2026-4029

    Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export

    		7.5
    MediumCVE-2024-3901

    Genesis Blocks <= 3.1.3 - Contributor+ Stored XSS

    		6.8
    MediumCVE-2024-2761

    Genesis Blocks < 3.1.3 - Contributor+ Stored XSS

    		6.8
    MediumCVE-2026-8382

    Wpengine Advanced Custom Fields (ACF®): Missing Authorization

    		5.3
    MediumCVE-2025-11427

    WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery

    		5.8
    MediumCVE-2022-1563

    WPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes Disclosure

    		5.3
    MediumCVE-2023-6701

    Wpengine Advanced Custom Fields (ACF®): Cross-site Scripting

    also in 2 other products

    		6.4
    MediumCVE-2022-4974

    Freemius SDK <= 2.4.2 - Missing Authorization Checks

    also in 154 other products

    		6.3
    MediumCVE-2024-45429

    WP Engine Advanced Custom Fields: Cross-Site Scripting (XSS)

    also in 2 other products

    		6.1
    MediumCVE-2024-3563

    StudioPress Genesis Blocks: Cross-site Scripting

    		6.4
    MediumCVE-2023-23684

    WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)

    also in 1 other product

    		4.4
    HighCVE-2023-24421

    WP Engine PHP Compatibility Checker: Cross-Site Request Forgery (CSRF)

    also in 1 other product

    		5.4

    Products

    Products by WP Engine
    WPGraphQL50
    Advanced Custom Fields (acf®)30
    Database Backup For Wordpress30
    Genesis Blocks30