WordPress vulnerabilities
39 CVEs and advisories name WordPress as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-87902An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the
- CVE-2026-65640WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.
- CVE-2026-64638WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
- CVE-2026-45293WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability
- CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
- CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
- CVE-2020-37233WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting
- CVE-2023-54333Social-Share-Buttons 2.2.3 - SQL Injection via project_id Parameter
- CVE-2025-58674WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability
- CVE-2025-58246WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability
- CVE-2025-54352WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests.
- CVE-2024-31211Remote Code Execution in `WP_HTML_Token`
- CVE-2024-31210PHP file upload bypass via Plugin installer
- CVE-2023-5561WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure
- CVE-2022-3590WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding
- CVE-2022-21662Stored XSS in WordPress
- CVE-2022-21663Authenticated Object Injection in Multisites in WordPress
- CVE-2022-21664SQL injection in WordPress
- CVE-2022-21661SQL injection in WordPress
- CVE-2021-39203Private data disclosure/privilege escalation through the block editor in Wordpress
- CVE-2021-39202WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widget
- CVE-2021-39201Authenticated cross-site scripting (XSS) in WordPress editor
- CVE-2021-39200Information Disclosure in wp_die() via JSONP in wordpress
- CVE-2021-29476Insecure Deserialization of untrusted data in rmccue/requests
- CVE-2021-29450WordPress Authenticated disclosure of password-protected posts and pages
- CVE-2021-29447WordPress Authenticated XXE attack when installation is running PHP 8
- CVE-2020-4047Authenticated XSS via media attachment page in WordPress
- CVE-2020-4048Open redirect in wp_validate_redirect() in WordPress
- CVE-2020-4049Authenticated self-XSS via theme uploads in WordPress
- CVE-2020-4050set-screen-option filter misuse by plugins leading to privilege escalation in WordPress