News stories · 30d
5
Advisories · 30d
1
Added to KEV · 90d
1
Actively exploited (CISA KEV)
| Added | CVE | Product | Vulnerability | Ransomware |
|---|---|---|---|---|
| 2026-09-25 | CVE-2026-87902 | Core | WordPress Core Remote File Inclusion Vulnerability | |
| 2026-07-21 | CVE-2026-60137 | Core | WordPress Core SQL Injection Vulnerability | |
| 2026-07-21 | CVE-2026-63030 | Core | WordPress Core Interpretation Conflict Vulnerability | |
| 2026-04-30 | CVE-2026-41940 | cPanel & WHM and WP2 (WordPress Squared) | WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability | Known |
| 2021-11-03 | CVE-2020-25213 | File Manager Plugin | WordPress File Manager Plugin Remote Code Execution Vulnerability | |
| 2021-11-03 | CVE-2020-11738 | Snap Creek Duplicator Plugin | WordPress Snap Creek Duplicator Plugin File Download Vulnerability | |
| 2021-11-03 | CVE-2019-9978 | Social Warfare Plugin | WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability |
CVEs in the news
Timeline (last 30 days)
- Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE — The Hacker News +2 sources, 2026-10-12
- Ninja Forms plugin flaw exploited to hack WordPress sites — BleepingComputer, 2026-10-06
- WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory — The Hacker News, 2026-10-01
- TIKTOUK: Tracing a WordPress Credential Collection Toolkit — LevelBlue SpiderLabs, 2026-10-01
- [webapps] WordPress 7.0.2 - Path Travesal — Exploit-DB, 2026-10-01
- Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation — GreyNoise, 2026-09-21