WordPress

5 results · Clear filters · Feed

• High 8.1
  CVE-2026-87902 Exploited Public exploit EPSS 96%

  An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.p…

  WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
  Sep 22, 2026

  KEV Sep 25, 2026
• High 8.8
  CVE-2026-65640 Public exploit

  WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author leve…

  WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
  Aug 17, 2026
• High 8.9
  CVE-2026-64638 Public exploit

  WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted maliciou…

  WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
  Aug 7, 2026
• High 8.0
  CVE-2022-21661 Public exploit EPSS 98%

  SQL injection in WordPress

  WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain wa…

  WordPress wordpress-develop wordpress wordpress Web / CMS Debian Ubuntu
  Jan 6, 2022
• High 7.1
  CVE-2021-29447 Public exploit EPSS 86%

  WordPress Authenticated XXE attack when installation is running PHP 8

  Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possibl…

  WordPress wordpress-develop wordpress wordpress Web / CMS Debian Ubuntu
  Apr 15, 2021