# Wordpress vulnerabilities Source: https://junglewise.ai/threats/technologies/wordpress Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/wordpress.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 19 vulnerabilities in Wordpress: 0 in the last 7 days and 3 in the last 90 days, 5 of them critical and 4 exploited in the wild. The most recent, CVE-2026-119977, was published on 31 October 2026. 2 vulnerabilities in the last four weeks, up 100% on the four before (1). 1 critical against 1, 1 exploited in the wild against 1. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 3 - All time: 19 (5 critical, 4 exploited in the wild) ## About Wordpress Open-source blogging platform and content management system. ## Latest Wordpress vulnerabilities - [CVE-2026-119977: WordPress Core remote code execution in upgrade path](https://junglewise.ai/threats/cve-2026-119977-wordpress-core-is-vulnerable-to-remote-code-execution-in) (critical, exploited in the wild, CVSS 8.1, published 31 Oct 2026) - [CVE-2026-114570: WordPress Core stored cross-site scripting in Quick Edit](https://junglewise.ai/threats/cve-2026-114570-wordpress-core-is-vulnerable-to-stored-cross-site-scripting-via) (medium, CVSS 4.9, published 22 Oct 2026) - [CVE-2026-87902: WordPress Core remote file inclusion](https://junglewise.ai/threats/cve-2026-87902-wordpress-core-remote-file-inclusion) (critical, exploited in the wild, CVSS 8.1, published 22 Sep 2026) - [CVE-2026-63030: WordPress REST API route confusion and SQL injection leading to RCE](https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to) (critical, exploited in the wild, CVSS 7.5, published 17 Jul 2026) - [CVE-2026-60137: WordPress SQL injection in WP_Query author__not_in parameter](https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter) (critical, exploited in the wild, CVSS 9.1, published 17 Jul 2026) - [CVE-2016-4567: MediaElement.js Reflected XSS in FlashMediaElement component](https://junglewise.ai/threats/cve-2016-4567-mediaelement-js-reflected-xss-in-flashmediaelement-component) (low, CVSS 3, published 17 May 2022) - [CVE-2017-5612: WordPress XSS in posts list table excerpt](https://junglewise.ai/threats/cve-2017-5612-wordpress-xss-in-posts-list-table-excerpt) (medium, CVSS 6.1, published 30 Jan 2017) - [CVE-2017-5611: WordPress WP_Query SQL injection in post type handling](https://junglewise.ai/threats/cve-2017-5611-wordpress-wp-query-sql-injection-in-post-type-handling) (critical, CVSS 9.8, published 30 Jan 2017) - [CVE-2017-5610: WordPress Press This information exposure in taxonomy UI](https://junglewise.ai/threats/cve-2017-5610-wordpress-press-this-information-exposure-in-taxonomy-ui) (medium, CVSS 5.3, published 30 Jan 2017) - [CVE-2016-6897: WordPress CSRF and Path Traversal in wp_ajax_update_plugin](https://junglewise.ai/threats/cve-2016-6897-wordpress-csrf-and-path-traversal-in-wp-ajax-update-plugin) (medium, CVSS 6.5, published 18 Jan 2017) - [CVE-2016-6896: WordPress directory traversal in wp_ajax_update_plugin](https://junglewise.ai/threats/cve-2016-6896-wordpress-directory-traversal-in-wp-ajax-update-plugin) (high, CVSS 7.1, published 18 Jan 2017) - [CVE-2016-10148: WordPress improper access control in wp_ajax_update_plugin](https://junglewise.ai/threats/cve-2016-10148-wordpress-improper-access-control-in-wp-ajax-update-plugin) (medium, CVSS 4.3, published 18 Jan 2017) - [CVE-2017-5493: WordPress Multisite weak random number generation in activation keys](https://junglewise.ai/threats/cve-2017-5493-wordpress-multisite-weak-random-number-generation-in-activation) (high, CVSS 7.5, published 15 Jan 2017) - [CVE-2017-5492: WordPress CSRF in widget-editing accessibility mode](https://junglewise.ai/threats/cve-2017-5492-wordpress-csrf-in-widget-editing-accessibility-mode) (high, CVSS 8.8, published 15 Jan 2017) - [CVE-2017-5491: WordPress bypass of posting restrictions in wp-mail.php](https://junglewise.ai/threats/cve-2017-5491-wordpress-bypass-of-posting-restrictions-in-wp-mail-php) (medium, CVSS 5.3, published 15 Jan 2017) - [CVE-2017-5490: WordPress XSS in theme-name fallback functionality](https://junglewise.ai/threats/cve-2017-5490-wordpress-xss-in-theme-name-fallback-functionality) (medium, CVSS 6.1, published 15 Jan 2017) - [CVE-2017-5489: WordPress CSRF bypass via Flash file upload](https://junglewise.ai/threats/cve-2017-5489-wordpress-csrf-bypass-via-flash-file-upload) (high, CVSS 8.8, published 15 Jan 2017) - [CVE-2017-5488: WordPress XSS in update-core.php via plugin headers](https://junglewise.ai/threats/cve-2017-5488-wordpress-xss-in-update-core-php-via-plugin-headers) (medium, CVSS 6.1, published 15 Jan 2017) - [CVE-2017-5487: WordPress REST API information disclosure in users controller](https://junglewise.ai/threats/cve-2017-5487-wordpress-rest-api-information-disclosure-in-users-controller) (medium, CVSS 5.3, published 15 Jan 2017) ## Most severe Wordpress vulnerabilities - [CVE-2026-60137: WordPress SQL injection in WP_Query author__not_in parameter](https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter) (critical, exploited in the wild, CVSS 9.1, published 17 Jul 2026) - [CVE-2026-87902: WordPress Core remote file inclusion](https://junglewise.ai/threats/cve-2026-87902-wordpress-core-remote-file-inclusion) (critical, exploited in the wild, CVSS 8.1, published 22 Sep 2026) - [CVE-2026-119977: WordPress Core remote code execution in upgrade path](https://junglewise.ai/threats/cve-2026-119977-wordpress-core-is-vulnerable-to-remote-code-execution-in) (critical, exploited in the wild, CVSS 8.1, published 31 Oct 2026) - [CVE-2026-63030: WordPress REST API route confusion and SQL injection leading to RCE](https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to) (critical, exploited in the wild, CVSS 7.5, published 17 Jul 2026) - [CVE-2017-5611: WordPress WP_Query SQL injection in post type handling](https://junglewise.ai/threats/cve-2017-5611-wordpress-wp-query-sql-injection-in-post-type-handling) (critical, CVSS 9.8, published 30 Jan 2017) - [CVE-2017-5492: WordPress CSRF in widget-editing accessibility mode](https://junglewise.ai/threats/cve-2017-5492-wordpress-csrf-in-widget-editing-accessibility-mode) (high, CVSS 8.8, published 15 Jan 2017) - [CVE-2017-5489: WordPress CSRF bypass via Flash file upload](https://junglewise.ai/threats/cve-2017-5489-wordpress-csrf-bypass-via-flash-file-upload) (high, CVSS 8.8, published 15 Jan 2017) - [CVE-2017-5493: WordPress Multisite weak random number generation in activation keys](https://junglewise.ai/threats/cve-2017-5493-wordpress-multisite-weak-random-number-generation-in-activation) (high, CVSS 7.5, published 15 Jan 2017) - [CVE-2016-6896: WordPress directory traversal in wp_ajax_update_plugin](https://junglewise.ai/threats/cve-2016-6896-wordpress-directory-traversal-in-wp-ajax-update-plugin) (high, CVSS 7.1, published 18 Jan 2017) - [CVE-2016-6897: WordPress CSRF and Path Traversal in wp_ajax_update_plugin](https://junglewise.ai/threats/cve-2016-6897-wordpress-csrf-and-path-traversal-in-wp-ajax-update-plugin) (medium, CVSS 6.5, published 18 Jan 2017) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up 100% on the four before (1). 1 critical against 1, 1 exploited in the wild against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 1 | 1 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 1 | 1 | 1 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Wordpress technologies - [Wordpress Download Manager](https://junglewise.ai/threats/technologies/wordpress-download-manager): 4 vulnerabilities - [Wordpress Advanced Customized Prompts](https://junglewise.ai/threats/technologies/advanced-customized-prompts): 3 vulnerabilities - [Wordpress Filter Gallery](https://junglewise.ai/threats/technologies/filter-gallery): 3 vulnerabilities - [Wordpress Login & Register Forms](https://junglewise.ai/threats/technologies/login-register-forms): 3 vulnerabilities - [Wordpress User Access Manager](https://junglewise.ai/threats/technologies/user-access-manager): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Wordpress vulnerabilities", https://junglewise.ai/threats/technologies/wordpress, 12 November 2026.