Exploited vulnerabilities
WordPress
7 WordPress vulnerabilities in the CISA KEV catalogue: those for which the US cybersecurity agency has evidence of exploitation in real attacks.
In the catalogue7
Last 12 months4
In ransomware campaigns0
Last addition3 November 2026
The vulnerabilities7
- 3 November 2026CVE-2026-119977WordPress CoreWordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
- 25 September 2026CVE-2026-87902CoreWordPress Core Remote File Inclusion Vulnerability
- 21 July 2026CVE-2026-63030CoreWordPress Core Interpretation Conflict Vulnerability
- 21 July 2026CVE-2026-60137CoreWordPress Core SQL Injection Vulnerability
- 3 November 2021CVE-2020-25213File Manager PluginWordPress File Manager Plugin Remote Code Execution Vulnerability
- 3 November 2021CVE-2020-11738Snap Creek Duplicator PluginWordPress Snap Creek Duplicator Plugin File Download Vulnerability
- 3 November 2021CVE-2019-9978Social Warfare PluginWordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
Data: CISA Known Exploited Vulnerabilities (KEV) catalogue, last addition on 4 November 2026.
The catalogue lists only vulnerabilities with evidence of exploitation, not all of the vendor's vulnerabilities.
Alerts only on the products you use
With My Defence you receive alerts and briefings only on the products you use, WordPress included.