Skip to content
Exploit Radar Choose my productsProducts My radar
English

Products › Brands

Brand

WordPress: actively exploited vulnerabilities

6 vulnerabilities in WordPress products (Core, Plugins) are in CISA’s catalog of exploited vulnerabilities, 3 of them added in the last 90 days. Last added: September 25, 2026.

WordPress security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

By category

Add just one WordPress category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

  • Core 3 vulnerabilities · CMS and websites
  • Plugins 3 vulnerabilities · CMS and websites

Name used by CISA: WordPress. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this WordPress list.

  1. Rank 1WordPress Core

    CVE-2026-87902

    Recently addedHunt for compromise (CISA)

    WordPress Core Remote File Inclusion Vulnerability

    Added to the catalog less than 30 days ago: ranked by date added.

    Added
    Sep 25, 2026
    CISA deadline
    3 days
    CVSS severity
    8.1 (high)

  2. Rank 2WordPress Core

    CVE-2026-63030

    Hunt for compromise (CISA)

    WordPress Core Interpretation Conflict Vulnerability

    Added in the last 12 months: ranked by severity.

    Added
    Jul 21, 2026
    CISA deadline
    3 days
    CVSS severity
    9.8 (critical)

  3. Rank 3WordPress Core

    CVE-2026-60137

    WordPress Core SQL Injection Vulnerability

    Added in the last 12 months: ranked by severity.

    Added
    Jul 21, 2026
    CISA deadline
    14 days
    CVSS severity
    5.9 (medium)

  4. Rank 4WordPress Plugins

    CVE-2020-25213

    WordPress File Manager Plugin Remote Code Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Nov 3, 2021
    CISA deadline
    181 days
    CVSS severity
    9.8 (critical)

  5. Rank 5WordPress Plugins

    CVE-2020-11738

    WordPress Snap Creek Duplicator Plugin File Download Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Nov 3, 2021
    CISA deadline
    181 days
    CVSS severity
    7.5 (high)

  6. Rank 6WordPress Plugins

    CVE-2019-9978

    CVE from 2019, added in 2021

    WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Nov 3, 2021
    CISA deadline
    181 days
    CVSS severity
    6.1 (medium)

Follow and verify

Get new WordPress vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.