Vendor
WordPress
As of , 6 WordPress vulnerabilities are on CISA's list of exploited vulnerabilities; 3 were added in 2026. Patch first: CVE-2026-63030.
Patch first
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2026-63030Interpretation Conflict | WordPress Core | Patch nowForensic triage required by CISA; Metasploit module | 0.10 | ||
| 2 | CVE-2026-87902Remote File Inclusion | WordPress Core | Patch nowForensic triage required by CISA; listed in the last 14 days | 0.46 | ||
| 3 | CVE-2020-25213Remote Code Execution | WordPress File Manager Plugin | Patch this weekMetasploit module; EPSS 0.97; verified Exploit-DB entry | 0.97 | ||
| 4 | CVE-2020-11738File Download | WordPress Snap Creek Duplicator Plugin | Patch this weekMetasploit module; EPSS 0.98 | 0.98 | ||
| 5 | CVE-2026-60137SQL Injection | WordPress Core | Patch this weekMetasploit module | 0.06 | ||
| 6 | CVE-2019-9978Cross-Site Scripting (XSS) | WordPress Social Warfare Plugin | Patch this weekEPSS 0.73 | 0.73 |
Products
- Core3 entries
- File Manager Plugin1 entry
- Snap Creek Duplicator Plugin1 entry
- Social Warfare Plugin1 entry
Added each year
Show the numbers
| Period | entries added |
|---|---|
| 2021 | 3 |
| 2022 | none |
| 2023 | none |
| 2024 | none |
| 2025 | none |
| 2026 | 3 |