# Wordpress vulnerabilities

Source: https://junglewise.ai/threats/vendors/wordpress  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 12 November 2026, 07:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/wordpress.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 191 vulnerabilities in Wordpress: 12 in the last 7 days and 115 in the last 90 days, 25 of them critical and 7 exploited in the wild. The most recent, CVE-2026-119039, was published on 12 November 2026. 33 vulnerabilities in the last four weeks, down 31% on the four before (48). 5 critical against 5, 1 exploited in the wild against 1. 6 technologies have a page of their own.

## Counts

- Last 7 days: 12
- Last 30 days: 41
- Last 90 days: 115
- All time: 191 (25 critical, 7 exploited in the wild)

## About Wordpress

WordPress is an open-source content management system based on PHP and MySQL.

## Latest Wordpress vulnerabilities

- [CVE-2026-119039: Defender Security WordPress plugin IP spoofing via Smart IP Detection](https://junglewise.ai/threats/cve-2026-119039-the-defender-security-wordpress-plugin-before-6-4-1-does-not) (info, published 12 Nov 2026)
- [CVE-2026-110041: WordPress Crop Thumbnails plugin authorization bypass in REST endpoints](https://junglewise.ai/threats/cve-2026-110041-the-crop-thumbnails-wordpress-plugin-before-1-10-0-does-not) (info, published 12 Nov 2026)
- [CVE-2026-121863: Knowledge Building WordPress plugin reflected XSS in AJAX](https://junglewise.ai/threats/cve-2026-121863-the-knowledge-building-wordpress-plugin-before-0-7-3-does-not) (info, published 11 Nov 2026)
- [CVE-2026-119531: Live Composer stored XSS in page-builder shortcode](https://junglewise.ai/threats/cve-2026-119531-the-live-composer-wordpress-plugin-before-2-1-24-does-not-escape) (info, published 11 Nov 2026)
- [CVE-2026-119033: Schema & Structured Data for WP & AMP broken access control in post settings](https://junglewise.ai/threats/cve-2026-119033-the-schema-structured-data-for-wp-amp-wordpress-plugin-before-1) (info, published 11 Nov 2026)
- [CVE-2026-115734: WordPress Pay with a Tweet arbitrary file deletion](https://junglewise.ai/threats/cve-2026-115734-the-pay-with-a-tweet-wordpress-plugin-through-1-0-5-does-not) (info, published 11 Nov 2026)
- [CVE-2026-110948: Download Manager WordPress plugin access control bypass in media preview](https://junglewise.ai/threats/cve-2026-110948-the-download-manager-wordpress-plugin-before-3-3-73-download) (info, published 11 Nov 2026)
- [CVE-2026-109873: User Registration & Membership authentication bypass via omitted membership field](https://junglewise.ai/threats/cve-2026-109873-the-user-registration-membership-wordpress-plugin-before-5-3-2) (info, published 11 Nov 2026)
- [CVE-2026-120531: Subscribe2 stored cross-site scripting in dataip parameter](https://junglewise.ai/threats/cve-2026-120531-the-subscribe2-form-email-subscribers-newsletters-plugin-for) (high, CVSS 7.2, published 7 Nov 2026)
- [CVE-2026-121796: Add From Server Reloaded stored XSS via SVG upload](https://junglewise.ai/threats/cve-2026-121796-the-add-from-server-lite-wordpress-plugin-before-6-0-0-does-not) (info, published 7 Nov 2026)
- [CVE-2026-120555: Jupiter X Core directory traversal in file parameter](https://junglewise.ai/threats/cve-2026-120555-the-jupiter-x-core-plugin-for-wordpress-is-vulnerable-to) (medium, CVSS 5.3, published 7 Nov 2026)
- [CVE-2026-119259: All-in-One Video Gallery unauthenticated meta write](https://junglewise.ai/threats/cve-2026-119259-the-all-in-one-video-gallery-wordpress-plugin-before-5-1-0-does) (info, published 6 Nov 2026)
- [CVE-2026-118637: Simple Download Monitor information disclosure via shortcode](https://junglewise.ai/threats/cve-2026-118637-the-simple-download-monitor-wordpress-plugin-before-4-1-3-does) (info, published 4 Nov 2026)
- [CVE-2026-120578: AI Alt Text Generator authorization bypass in attachment modification](https://junglewise.ai/threats/cve-2026-120578-the-ai-alt-text-generator-plugin-for-wordpress-is-vulnerable-to) (medium, CVSS 5.3, published 3 Nov 2026)
- [CVE-2026-76010: NextGEN Gallery remote code execution via unrestricted mass assignment](https://junglewise.ai/threats/cve-2026-76010-the-photo-gallery-sliders-proofing-and-themes-nextgen-gallery) (high, CVSS 8.8, published 31 Oct 2026)
- [CVE-2026-120114: Debug Log Manager plugin for WordPress stored XSS](https://junglewise.ai/threats/cve-2026-120114-the-debug-log-manager-conveniently-monitor-and-inspect-errors) (high, CVSS 7.2, published 31 Oct 2026)
- [CVE-2026-103915: WordPress Amelia plugin sensitive information exposure](https://junglewise.ai/threats/cve-2026-103915-the-booking-for-appointments-and-events-calendar-amelia-plugin) (medium, CVSS 5.3, published 31 Oct 2026)
- [CVE-2026-101325: WordPress Newsletters plugin SQL injection via id parameter](https://junglewise.ai/threats/cve-2026-101325-the-newsletters-plugin-for-wordpress-is-vulnerable-to-time-based) (medium, CVSS 5.3, published 31 Oct 2026)
- [CVE-2026-119977: WordPress Core remote code execution in upgrade path](https://junglewise.ai/threats/cve-2026-119977-wordpress-core-is-vulnerable-to-remote-code-execution-in) (critical, exploited in the wild, CVSS 8.1, published 31 Oct 2026)
- [CVE-2026-118184: Premium Packages WordPress plugin unauthenticated price manipulation](https://junglewise.ai/threats/cve-2026-118184-the-premium-packages-wordpress-plugin-before-7-2-2-does-not) (info, published 31 Oct 2026)
- [CVE-2025-8574: Database Cleaner plugin arbitrary table deletion](https://junglewise.ai/threats/cve-2025-8574-the-database-cleaner-plugin-for-wordpress-is-vulnerable-to) (high, CVSS 8.7, published 30 Oct 2026)
- [CVE-2026-114422: Enable Media Replace PHP object injection in metadata deserialization](https://junglewise.ai/threats/cve-2026-114422-the-enable-media-replace-wordpress-plugin-before-4-2-3-does-not) (info, published 30 Oct 2026)
- [CVE-2026-62018: Gunslinger WordPress theme PHP Object Injection](https://junglewise.ai/threats/cve-2026-62018-unauthenticated-php-object-injection-in-gunslinger-1-11-versions) (critical, CVSS 9.8, published 29 Oct 2026)
- [CVE-2026-62003: WordPress Mission theme PHP object injection](https://junglewise.ai/threats/cve-2026-62003-unauthenticated-php-object-injection-in-mission-1-22-versions) (critical, CVSS 9.8, published 29 Oct 2026)
- [CVE-2026-61997: WordPress Legal Stone PHP Object Injection](https://junglewise.ai/threats/cve-2026-61997-unauthenticated-php-object-injection-in-legal-stone-1-2-11) (critical, CVSS 9.8, published 29 Oct 2026)

## Most severe Wordpress vulnerabilities

- [CVE-2020-25213: WordPress File Manager Plugin Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2020-25213-wordpress-file-manager-plugin-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 3 Nov 2021)
- [CVE-2026-60137: WordPress SQL injection in WP_Query author__not_in parameter](https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter) (critical, exploited in the wild, CVSS 9.1, published 17 Jul 2026)
- [CVE-2026-87902: WordPress Core remote file inclusion](https://junglewise.ai/threats/cve-2026-87902-wordpress-core-remote-file-inclusion) (critical, exploited in the wild, CVSS 8.1, published 22 Sep 2026)
- [CVE-2026-119977: WordPress Core remote code execution in upgrade path](https://junglewise.ai/threats/cve-2026-119977-wordpress-core-is-vulnerable-to-remote-code-execution-in) (critical, exploited in the wild, CVSS 8.1, published 31 Oct 2026)
- [CVE-2026-63030: WordPress REST API route confusion and SQL injection leading to RCE](https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to) (critical, exploited in the wild, CVSS 7.5, published 17 Jul 2026)
- [CVE-2020-11738: WordPress Snap Creek Duplicator Plugin File Download Vulnerability](https://junglewise.ai/threats/cve-2020-11738-wordpress-snap-creek-duplicator-plugin-file-download) (critical, exploited in the wild, CVSS 7.5, published 3 Nov 2021)
- [CVE-2019-9978: WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability](https://junglewise.ai/threats/cve-2019-9978-wordpress-social-warfare-plugin-cross-site-scripting-xss) (critical, exploited in the wild, CVSS 6.1, published 3 Nov 2021)
- [CVE-2026-4357: WordPress Embed HTML5 Game plugin unauthenticated file upload](https://junglewise.ai/threats/cve-2026-4357-wordpress-embed-html5-game-plugin-unauthenticated-file-upload) (critical, CVSS 10, published 2 Sep 2026)
- [CVE-2026-14560: WordPress Teddy Bear Customize Addon arbitrary file upload](https://junglewise.ai/threats/cve-2026-14560-wordpress-teddy-bear-customize-addon-arbitrary-file-upload) (critical, CVSS 10, published 11 Sep 2026)
- [CVE-2026-42719: Dynamic User Directory plugin PHP object injection](https://junglewise.ai/threats/cve-2026-42719-subscriber-php-object-injection-in-dynamic-user-directory-2-4) (critical, CVSS 9.8, published 10 Oct 2026)

## Vulnerabilities per week

33 vulnerabilities in the last four weeks, down 31% on the four before (48). 5 critical against 5, 1 exploited in the wild against 1.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 7 | 1 | 0 |
| 24 Aug 2026 | 2 | 0 | 0 |
| 31 Aug 2026 | 3 | 2 | 0 |
| 7 Sep 2026 | 12 | 4 | 0 |
| 14 Sep 2026 | 12 | 0 | 0 |
| 21 Sep 2026 | 8 | 1 | 1 |
| 28 Sep 2026 | 13 | 1 | 0 |
| 5 Oct 2026 | 15 | 3 | 0 |
| 12 Oct 2026 | 4 | 0 | 0 |
| 19 Oct 2026 | 6 | 0 | 0 |
| 26 Oct 2026 | 17 | 5 | 1 |
| 2 Nov 2026 | 6 | 0 | 0 |
| 9 Nov 2026 | 8 | 0 | 0 |

## Wordpress technologies

- [Wordpress](https://junglewise.ai/threats/technologies/wordpress): 19 vulnerabilities
- [Wordpress Download Manager](https://junglewise.ai/threats/technologies/wordpress-download-manager): 4 vulnerabilities
- [Wordpress Advanced Customized Prompts](https://junglewise.ai/threats/technologies/advanced-customized-prompts): 3 vulnerabilities
- [Wordpress Filter Gallery](https://junglewise.ai/threats/technologies/filter-gallery): 3 vulnerabilities
- [Wordpress Login & Register Forms](https://junglewise.ai/threats/technologies/login-register-forms): 3 vulnerabilities
- [Wordpress User Access Manager](https://junglewise.ai/threats/technologies/user-access-manager): 3 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Wordpress vulnerabilities", https://junglewise.ai/threats/vendors/wordpress, 12 November 2026.