Vendor
Wordpress vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 191 vulnerabilities in Wordpress: 12 in the last 7 days and 115 in the last 90 days, 25 of them critical and 7 exploited in the wild. The most recent, CVE-2026-119039, was published on 12 November 2026. 33 vulnerabilities in the last four weeks, down 31% on the four before (48). 5 critical against 5, 1 exploited in the wild against 1. 6 technologies have a page of their own.
- Last 7 days
- 12
- Last 90 days
- 115
- Critical, all time
- 25
- Exploited in the wild
- 7
About Wordpress
WordPress is an open-source content management system based on PHP and MySQL.
Wordpress technologies
Latest Wordpress vulnerabilities
- CVE-2026-119039: Defender Security WordPress plugin IP spoofing via Smart IP Detectioninfo
- CVE-2026-110041: WordPress Crop Thumbnails plugin authorization bypass in REST endpointsinfo
- CVE-2026-121863: Knowledge Building WordPress plugin reflected XSS in AJAXinfo
- CVE-2026-119531: Live Composer stored XSS in page-builder shortcodeinfo
- CVE-2026-119033: Schema & Structured Data for WP & AMP broken access control in post settingsinfo
- CVE-2026-115734: WordPress Pay with a Tweet arbitrary file deletioninfo
- CVE-2026-110948: Download Manager WordPress plugin access control bypass in media previewinfo
- CVE-2026-109873: User Registration & Membership authentication bypass via omitted membership fieldinfo
- CVE-2026-120531: Subscribe2 stored cross-site scripting in data[ip] parameterhighCVSS 7.2
- CVE-2026-121796: Add From Server Reloaded stored XSS via SVG uploadinfo
- CVE-2026-120555: Jupiter X Core directory traversal in file parametermediumCVSS 5.3
- CVE-2026-119259: All-in-One Video Gallery unauthenticated meta writeinfo
- CVE-2026-118637: Simple Download Monitor information disclosure via shortcodeinfo
- CVE-2026-120578: AI Alt Text Generator authorization bypass in attachment modificationmediumCVSS 5.3
- CVE-2026-76010: NextGEN Gallery remote code execution via unrestricted mass assignmenthighCVSS 8.8
- CVE-2026-120114: Debug Log Manager plugin for WordPress stored XSShighCVSS 7.2
- CVE-2026-103915: WordPress Amelia plugin sensitive information exposuremediumCVSS 5.3
- CVE-2026-101325: WordPress Newsletters plugin SQL injection via id parametermediumCVSS 5.3
- CVE-2026-119977: WordPress Core remote code execution in upgrade pathcriticalexploited in the wildCVSS 8.1EPSS 0.6%
- CVE-2026-118184: Premium Packages WordPress plugin unauthenticated price manipulationinfo
- CVE-2025-8574: Database Cleaner plugin arbitrary table deletionhighCVSS 8.7
- CVE-2026-114422: Enable Media Replace PHP object injection in metadata deserializationinfo
- CVE-2026-62018: Gunslinger WordPress theme PHP Object InjectioncriticalCVSS 9.8
- CVE-2026-62003: WordPress Mission theme PHP object injectioncriticalCVSS 9.8
- CVE-2026-61997: WordPress Legal Stone PHP Object InjectioncriticalCVSS 9.8
Most severe Wordpress vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2020-25213: WordPress File Manager Plugin Remote Code Execution Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2026-60137: WordPress SQL injection in WP_Query author__not_in parametercriticalexploited in the wildCVSS 9.1EPSS 4.0%
- CVE-2026-87902: WordPress Core remote file inclusioncriticalexploited in the wildCVSS 8.1EPSS 2.9%
- CVE-2026-119977: WordPress Core remote code execution in upgrade pathcriticalexploited in the wildCVSS 8.1EPSS 0.6%
- CVE-2026-63030: WordPress REST API route confusion and SQL injection leading to RCEcriticalexploited in the wildCVSS 7.5EPSS 8.9%
- CVE-2020-11738: WordPress Snap Creek Duplicator Plugin File Download Vulnerabilitycriticalexploited in the wildCVSS 7.5
- CVE-2019-9978: WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerabilitycriticalexploited in the wildCVSS 6.1
- CVE-2026-4357: WordPress Embed HTML5 Game plugin unauthenticated file uploadcriticalCVSS 10EPSS 0.5%
- CVE-2026-14560: WordPress Teddy Bear Customize Addon arbitrary file uploadcriticalCVSS 10EPSS 0.4%
- CVE-2026-42719: Dynamic User Directory plugin PHP object injectioncriticalCVSS 9.8EPSS 0.5%
Vulnerabilities per week
33 vulnerabilities in the last four weeks, down 31% on the four before (48). 5 critical against 5, 1 exploited in the wild against 1. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 7 | 1 | |
| 24 Aug 2026 | 2 | 0 | |
| 31 Aug 2026 | 3 | 2 | |
| 7 Sep 2026 | 12 | 4 | |
| 14 Sep 2026 | 12 | 0 | |
| 21 Sep 2026 | 8 | 1 | |
| 28 Sep 2026 | 13 | 1 | |
| 5 Oct 2026 | 15 | 3 | |
| 12 Oct 2026 | 4 | 0 | |
| 19 Oct 2026 | 6 | 0 | |
| 26 Oct 2026 | 17 | 5 | |
| 2 Nov 2026 | 6 | 0 | |
| 9 Nov 2026 | 8 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Wordpress vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/wordpress)<a href="https://junglewise.ai/threats/vendors/wordpress"><img src="https://junglewise.ai/threats/vendors/wordpress/badge.svg" alt="Wordpress vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/wordpress.json, and this page as text at https://junglewise.ai/threats/vendors/wordpress.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Wordpress vulnerabilities", https://junglewise.ai/threats/vendors/wordpress, 12 November 2026.