W
Vendor security profile6 actively exploited CVEs
wordpress
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs11
Critical1
CISA KEV6
Public exploit8
Patch rate%9
Avg. CVSS7.5
12-month vulnerability rate
0
0
0
0
0
0
0
0
2
2
2
1
CVE KEV
CVE severity distribution
11toplam CVE
Critical1 (9%)
High4 (36%)
Medium3 (27%)
Uncertain3 (27%)
Patch and exploitation view
%9
Verified patch
%55
CISA KEV
%73
Public exploit
1Patch available
0Partial
6Workaround
0Vendor: no patch
4Unknown
Latest vulnerabilities
9.3
CVE-2026-41555
WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability
W–
Patch status unknownEPSS %0
7.5
CVE-2026-39796
WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability
FC
Patch status unknownEPSS %0
5.3
CVE-2026-100508
WordPress Two Factor plugin <= 0.16.0 - Denial of Service Attack vulnerability
W
Patch status unknownEPSS %0
8.1
CVE-2026-87902 Actively exploited
Vulnerability in WordPress
W
WorkaroundEPSS %40
8.8
CVE-2026-4327
The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
S
Patch status unknownEPSS %1
8.5
CVE-2026-74013
WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerability
W
Patch status unknownEPSS %0
8.8
CVE-2026-65640
Unrestricted file upload in WordPress
W
Patch status unknownEPSS %2
8.9
CVE-2026-64638
Cross-site scripting in WordPress
W
Patch status unknownEPSS %1
9.8
CVE-2026-63030 Actively exploited
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
W
WorkaroundEPSS %11
5.9
CVE-2026-60137 Actively exploited
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
W
WorkaroundEPSS %5