# cve.now: WordPress

The newest entries naming WordPress as an affected vendor (up to 200), of 39 in all, 3 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-87902](https://cve.now/CVE-2026-87902.md): An unauthenticated attacker can make \`get\_page\_template()\` page-template resolution include a chosen readable local \`.php\` file outside the (CVSS 8.1, KEV)
- [CVE-2026-65640](https://cve.now/CVE-2026-65640.md): WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. (CVSS 8.8)
- [CVE-2026-64638](https://cve.now/CVE-2026-64638.md): WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. (CVSS 8.9)
- [CVE-2026-45293](https://cve.now/CVE-2026-45293.md): WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability (CVSS 8.6)
- [CVE-2026-63030](https://cve.now/CVE-2026-63030.md): WordPress \< 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution (CVSS 9.8, KEV)
- [CVE-2026-60137](https://cve.now/CVE-2026-60137.md): WordPress \< 7.0.2 - Facilitated SQL Injection via author\_\_not\_in in WP\_Query (CVSS 5.9, KEV)
- [CVE-2020-37233](https://cve.now/CVE-2020-37233.md): WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting (CVSS 5.1)
- [CVE-2023-54333](https://cve.now/CVE-2023-54333.md): Social-Share-Buttons 2.2.3 - SQL Injection via project\_id Parameter (CVSS 8.8)
- [CVE-2025-58674](https://cve.now/CVE-2025-58674.md): WordPress \<= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
- [CVE-2025-58246](https://cve.now/CVE-2025-58246.md): WordPress \<= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability (CVSS 4.3)
- [CVE-2025-54352](https://cve.now/CVE-2025-54352.md): WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. (CVSS 3.7)
- [CVE-2024-31211](https://cve.now/CVE-2024-31211.md): Remote Code Execution in \`WP\_HTML\_Token\` (CVSS 5.5)
- [CVE-2024-31210](https://cve.now/CVE-2024-31210.md): PHP file upload bypass via Plugin installer (CVSS 7.7)
- [CVE-2023-5561](https://cve.now/CVE-2023-5561.md): WordPress \< 6.3.2 - Unauthenticated Post Author Email Disclosure (CVSS 5.3)
- [CVE-2022-3590](https://cve.now/CVE-2022-3590.md): WP \<= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding (CVSS 5.9)
- [CVE-2022-21662](https://cve.now/CVE-2022-21662.md): Stored XSS in WordPress (CVSS 8.0)
- [CVE-2022-21663](https://cve.now/CVE-2022-21663.md): Authenticated Object Injection in Multisites in WordPress (CVSS 6.6)
- [CVE-2022-21664](https://cve.now/CVE-2022-21664.md): SQL injection in WordPress (CVSS 7.4)
- [CVE-2022-21661](https://cve.now/CVE-2022-21661.md): SQL injection in WordPress (CVSS 8.0)
- [CVE-2021-39203](https://cve.now/CVE-2021-39203.md): Private data disclosure/privilege escalation through the block editor in Wordpress (CVSS 6.8)
- [CVE-2021-39202](https://cve.now/CVE-2021-39202.md): WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widget (CVSS 7.6)
- [CVE-2021-39201](https://cve.now/CVE-2021-39201.md): Authenticated cross-site scripting (XSS) in WordPress editor (CVSS 7.6)
- [CVE-2021-39200](https://cve.now/CVE-2021-39200.md): Information Disclosure in wp\_die() via JSONP in wordpress (CVSS 5.3)
- [CVE-2021-29476](https://cve.now/CVE-2021-29476.md): Insecure Deserialization of untrusted data in rmccue/requests (CVSS 9.8)
- [CVE-2021-29450](https://cve.now/CVE-2021-29450.md): WordPress Authenticated disclosure of password-protected posts and pages (CVSS 6.5)
- [CVE-2021-29447](https://cve.now/CVE-2021-29447.md): WordPress Authenticated XXE attack when installation is running PHP 8 (CVSS 7.1)
- [CVE-2020-4047](https://cve.now/CVE-2020-4047.md): Authenticated XSS via media attachment page in WordPress (CVSS 6.8)
- [CVE-2020-4048](https://cve.now/CVE-2020-4048.md): Open redirect in wp\_validate\_redirect() in WordPress (CVSS 5.7)
- [CVE-2020-4049](https://cve.now/CVE-2020-4049.md): Authenticated self-XSS via theme uploads in WordPress (CVSS 2.4)
- [CVE-2020-4050](https://cve.now/CVE-2020-4050.md): set-screen-option filter misuse by plugins leading to privilege escalation in WordPress (CVSS 3.5)
- [CVE-2020-4046](https://cve.now/CVE-2020-4046.md): Authenticated XSS through embed block in WordPress (CVSS 5.4)
- [CVE-2020-11026](https://cve.now/CVE-2020-11026.md): Specially crafted filenames in WordPress leading to XSS (CVSS 8.7)
- [CVE-2020-11028](https://cve.now/CVE-2020-11028.md): Unauthenticated disclosure of certain private posts in WordPress (CVSS 5.8)
- [CVE-2020-11029](https://cve.now/CVE-2020-11029.md): Cross-site scripting in stats method (object cache) in WordPress (CVSS 5.8)
- [CVE-2020-11030](https://cve.now/CVE-2020-11030.md): Cross-site scripting (XSS) in Search block in WordPress (CVSS 6.4)
- [CVE-2020-11025](https://cve.now/CVE-2020-11025.md): Authenticated cross-site scripting (XSS) in WordPress Customizer (CVSS 5.8)
- [CVE-2020-11027](https://cve.now/CVE-2020-11027.md): Password reset links invalidation issue in WordPress (CVSS 6.1)
- [CVE-2019-16781](https://cve.now/CVE-2019-16781.md): Stored cross-site scripting (XSS) in WordPress block editor (CVSS 5.8)
- [CVE-2019-16780](https://cve.now/CVE-2019-16780.md): Stored cross-site scripting (XSS) in WordPress block editor (CVSS 5.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wordpress
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.