WordPress
Plugins, themes, and core releases that show up in public CVE catalogs.
1,446 public records currently classified under this stack.
Known exploited
All KEV for WordPress- Critical9.8PHPMailer Command Injection VulnerabilityKEVEPSS 99.7%Dec 30, 2016
- Critical9.3WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityKEVEPSS 98.5%Apr 29, 2026
- High7.5WordPress Snap Creek Duplicator Plugin File Download VulnerabilityKEVEPSS 97.8%Apr 13, 2020
- Critical9.8WordPress File Manager Plugin Remote Code Execution VulnerabilityKEVEPSS 97.3%Sep 9, 2020
- Medium6.1WordPress Social Warfare Plugin Cross-Site Scripting (XSS) VulnerabilityKEVEPSS 72.9%Mar 24, 2019
- High8.1WordPress Core Remote File Inclusion VulnerabilityKEVEPSS 40.0%Sep 22, 2026
- Critical9.8WordPress Core Interpretation Conflict VulnerabilityKEVEPSS 10.6%Jul 17, 2026
- Medium5.9WordPress Core SQL Injection VulnerabilityKEVEPSS 5.3%Jul 17, 2026
Recent WordPress findings
Full list- Medium5.4The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5.EPSS 0.2%Oct 16, 2026
- High7.5Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' ParameterOct 16, 2026
- Medium6.4Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode AttributeEPSS 0.2%Oct 16, 2026
- High7.2SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in CommentEPSS 0.3%Oct 16, 2026
- Medium6.4Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name ParameterOct 16, 2026
- High8.8DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment EndpointEPSS 0.5%Oct 16, 2026
- Medium6.4The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions…Oct 16, 2026
- High7.2The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting v…Oct 16, 2026
- High8.1The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of…Oct 16, 2026
- Medium6.4The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and i…EPSS 0.2%Oct 16, 2026