Vendor
WordPress.org vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 52 vulnerabilities in WordPress.org: 7 in the last 7 days and 51 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125844, was published on 11 November 2026. 20 vulnerabilities in the last four weeks, level on the four before (20).
- Last 7 days
- 7
- Last 90 days
- 51
- Critical, all time
- 0
- Exploited in the wild
- 0
About WordPress.org
Official WordPress project providing open-source website creation and content management software.
Latest WordPress.org vulnerabilities
- CVE-2026-125844: WordPress vice theme CSRF vulnerabilityhighCVSS 8.8
- CVE-2026-119615: Reset Database plugin for WordPress privilege escalationhighCVSS 8.8
- CVE-2026-119097: Author Image plugin for WordPress stored XSS via display_namemediumCVSS 6.4
- CVE-2026-116537: Link Library WordPress plugin stored XSS in link_descriptionhighCVSS 7.2
- CVE-2026-118204: WP Data Access stored cross-site scripting in image URL columnmediumCVSS 6.4
- CVE-2026-116545: All-in-One Video Gallery stored DOM-based XSS in track custom fieldsmediumCVSS 6.4
- CVE-2026-103908: AMP for WP arbitrary shortcode executionmediumCVSS 5.4
- CVE-2026-16304: WP Event Manager arbitrary post takeover via post identifier validationinfo
- CVE-2026-103898: WP Social Login and Register Social Counter authentication bypasshighCVSS 8.1
- CVE-2026-119162: User Submitted Posts plugin for WordPress stored DOM-based XSShighCVSS 7.2
- CVE-2026-107765: The Discussion Board stored cross-site scripting in user profilemediumCVSS 6.4
- CVE-2026-116851: eCommerce Product Catalog unauthenticated cross-site scriptinghighCVSS 7.1
- CVE-2026-104368: Export and Import Users and Customers plugin privilege escalationhighCVSS 8.8
- CVE-2026-93293: Password Protected WordPress plugin stored XSS in Freemius SDKmediumCVSS 6.4
- CVE-2026-116610: Clean Login WordPress plugin authorization bypass in shortcode handlermediumCVSS 4.3
- CVE-2026-116609: WordPress WP Visitor Statistics SQL injection in shortcodemediumCVSS 6.5
- CVE-2026-115807: User Profile Builder privilege escalation via Gutenberg Register blockhighCVSS 7.1
- CVE-2026-112219: Download Monitor WordPress plugin incorrect authorization in multisiteinfo
- CVE-2026-105996: WordPress Booking Package weak token generation in booking cancellationinfo
- CVE-2012-20003: WordPress Custom Tables reflected XSS in iframe.phpmediumCVSS 6.1
- CVE-2026-74922: Document Gallery WordPress plugin webhook signature bypassmediumCVSS 5.3
- CVE-2026-104000: Simply Schedule Appointments plugin stored cross-site scriptinghighCVSS 7.2EPSS 0.2%
- CVE-2026-109191: Image Hub WordPress plugin sensitive information exposuremediumCVSS 4.3EPSS 0.3%
- CVE-2026-103305: WordPress Prenotazioni plugin stored XSS in settingshighCVSS 8.8EPSS 0.2%
- CVE-2026-103427: Simple Membership plugin stored XSS in country parametermediumCVSS 6.4EPSS 0.2%
Most severe WordPress.org vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-16502: Live Composer PHP Object Injection via deserializationhighCVSS 8.8EPSS 0.4%
- CVE-2026-86583: Import and export users and customers plugin privilege escalationhighCVSS 8.8EPSS 0.3%
- CVE-2026-103305: WordPress Prenotazioni plugin stored XSS in settingshighCVSS 8.8EPSS 0.2%
- CVE-2026-125844: WordPress vice theme CSRF vulnerabilityhighCVSS 8.8
- CVE-2026-119615: Reset Database plugin for WordPress privilege escalationhighCVSS 8.8
- CVE-2026-104368: Export and Import Users and Customers plugin privilege escalationhighCVSS 8.8
- CVE-2026-66594: WordPress Persistent Login SQL injection in subscriber rolehighCVSS 8.5EPSS 0.4%
- CVE-2026-103898: WP Social Login and Register Social Counter authentication bypasshighCVSS 8.1
- CVE-2026-74020: Koji WordPress Theme broken access controlhighCVSS 7.5EPSS 0.4%
- CVE-2026-97337: Simple Membership WordPress plugin unauthorized account activation and credential disclosurehighCVSS 7.5EPSS 0.4%
Vulnerabilities per week
20 vulnerabilities in the last four weeks, level on the four before (20). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 3 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 3 | 0 | |
| 7 Sep 2026 | 2 | 0 | |
| 14 Sep 2026 | 4 | 0 | |
| 21 Sep 2026 | 6 | 0 | |
| 28 Sep 2026 | 7 | 0 | |
| 5 Oct 2026 | 3 | 0 | |
| 12 Oct 2026 | 2 | 0 | |
| 19 Oct 2026 | 5 | 0 | |
| 26 Oct 2026 | 8 | 0 | |
| 2 Nov 2026 | 5 | 0 | |
| 9 Nov 2026 | 3 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many WordPress.org vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/wordpress-org)<a href="https://junglewise.ai/threats/vendors/wordpress-org"><img src="https://junglewise.ai/threats/vendors/wordpress-org/badge.svg" alt="WordPress.org vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/wordpress-org.json, and this page as text at https://junglewise.ai/threats/vendors/wordpress-org.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "WordPress.org vulnerabilities", https://junglewise.ai/threats/vendors/wordpress-org, 13 November 2026.