Wordpress: community verdicts

3 notable / known-exploited Wordpress CVEs the community has triaged.

ⓘ Not an exhaustive list: we focus on the findings that matter (exploited / notable). For every Wordpress CVE, see NVD ↗.

Tracked Wordpress CVEs by year published3 tracked · select a year for details

Show as table

Year published	CVEs	In CISA KEV
2016	1	1
2017	0	0
2018	0	0
2019	0	0
2020	0	0
2021	0	0
2022	0	0
2023	0	0
2024	0	0
2025	0	0
2026	2	2

Exploitation first, with newly exploited CVEs rising above old ones

CVE-2026-63030CRIT 9.8KEVEPSS 11%
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
CVE-2016-10033CRIT 9.8KEVEPSS 100%
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.
CVE-2026-60137MED 5.9KEVEPSS 5%
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.