WordPress · versions
WordPress 6.4 security vulnerabilities
WordPress 6.4 refers to the WordPress core release line. Plugins and themes have separate version lines and often dominate real-world exposure.
Evidence status
25 version-linked advisories are attributed in this catalog (25 from version tokens). Zero matches is never proof WordPress 6.4 is secure. Coverage can lag vendor disclosure. Always verify the original advisory.
Version overview
- WordPress 6.4 core releases are tracked alongside plugin and theme advisories from Wordfence, Patchstack, and WPScan.
- Most WordPress incidents involve extensions, not core alone — always inventory plugins and themes.
Security advisories for WordPress 6.4
Confirmed catalog rows attributed to this version series via affected ranges, advisory text, or CVE-linked fix commits on 6.4.
Token-matched catalog rows
- Medium4.8The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2.Check if you run itEPSS 0.26%Oct 16, 2026
- UnknownStellarWP the_events_calendar Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 2.08%Oct 13, 2026
- UnknownStellarWP the_events_calendar Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 49.91%Oct 13, 2026
- Medium6.4The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direction' parameter of the Carousel Anything widget…Check if you run itEPSS 0.33%May 29, 2026
- Medium5.4The Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plugin before 2.6.4 is vulnerable to unauthorized modification of the Feeds for YouTube (Y…Check if you run itEPSS 0.32%May 18, 2026
- Medium6.4The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to stored cross-site scrip…Check if you run itEPSS 0.26%May 14, 2026
- Medium4.3The Rate Star Review Vote - AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4.Check if you run itEPSS 0.36%May 12, 2026
- Medium6.4The Gallagher Website Design plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's login_link shortcode in all versions up to, and includi…Check if you run itEPSS 0.25%Apr 22, 2026
- High8.8The Vertex Addons for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4.Check if you run itEPSS 0.82%Apr 9, 2026
- Medium6.4The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scrip…Check if you run itEPSS 0.26%Apr 8, 2026
- Medium5.4The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attachment post_title in all versions up to, and including, 6.4.3.Check if you run itEPSS 0.31%Mar 26, 2026
- Medium5.3The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Insufficient Verificati…Check if you run itEPSS 0.16%Feb 22, 2026
- Unknownbusinessdirectoryplugin business_directory Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 10.36%Jan 18, 2026
- Medium4.3The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up…Open the advisoryDec 5, 2025
- Medium4.3The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fip_save_Check if you run itEPSS 0.29%May 30, 2025
- Medium6.4The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 8.6.4 due to insufficient input sanitizationCheck this weekEPSS 24.00%May 22, 2025
- Medium5.4The Auto Affiliate Links WordPress plugin before 6.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacksCheck this weekEPSS 34.00%May 15, 2025
- Medium4.8The Events Calendar WordPress plugin before 6.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SiCheck this weekEPSS 36.00%May 15, 2025
- Medium5.3The PeepSo Core: File Uploads plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.6.0 via the file_download REST API enCheck this weekEPSS 30.00%May 14, 2025
- Critical9.1The Uncanny Automator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.4.0.1 via deserialization of untrusted input in the automatCheck if you run itEPSS 0.87%May 14, 2025
- Medium5.4The Uncanny Automator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in versions up to, and inCheck if you run itEPSS 0.29%May 14, 2025
- High7.2The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp_register_error XSS.Check this weekEPSS 27.00%Apr 28, 2025
- Medium4.8The Widget for Social Page Feeds WordPress plugin before 6.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform StCheck this weekEPSS 27.00%Apr 15, 2025
- UnknownEssential Addons for Elementor plugin for WordPress Missing Capability Checks and Nonce Disclosure VulnerbailityPatch nowKEVEPSS 0.26%Oct 15, 2024
- Unknownpixelite events_manager Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.31%Jul 1, 2024
Patch information
Public, disclosed Community fix commits attributed to 6.4. Proprietary Enterprise diffs are never shown.
No public disclosed fix commits for 6.4 are listed yet. Use the CVE version checker when you have a concrete SHA or package version.
Disclosed public references on file for 6.4: 0.
Security changes & hardening
Follow the WordPress security updates timeline for confirmed fixes, dependency remediations, and hardening events. Ordinary bugfixes are excluded from that timeline.
How to identify your installed revision
- wp-admin → Updates (or Tools) shows the running core version.
- `wp core version` via WP-CLI on the host.
- Compare each plugin’s version against its advisory ranges — core version alone is incomplete.
Security checker
Check a CVE against the exact version string you run — ranges are evaluated from catalog metadata.
Monitoring
Watch the WordPress stack for newly ingested advisories. Alerts follow your account package — they do not invent exploitability for WordPress 6.4.
Broader WordPress catalog
3,077 recordsOther recent WordPress findings that are not tied to WordPress 6.4. Use each CVE’s version checker before you treat one as in range.
- High7.7The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter befor…Open the advisoryOct 18, 2026
- Medium5.3The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, acceptin…Open the advisoryOct 18, 2026
- Medium4.9The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targe…Open the advisoryOct 18, 2026
- High7.1The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on…Open the advisoryOct 18, 2026
- Medium4.9The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an a…Open the advisoryOct 18, 2026
- Medium6.5The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authentic…Open the advisoryOct 18, 2026
- Medium4.3The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data…Open the advisoryOct 18, 2026
- Medium4.3The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a su…Open the advisoryOct 18, 2026
- Medium6.8The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publ…Open the advisoryOct 18, 2026
- Medium5.5The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen,…Open the advisoryOct 18, 2026
- High7.2The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other acc…Open the advisoryOct 18, 2026
- Medium4.9The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users wi…Open the advisoryOct 18, 2026