WordPress Core

Browse known vulnerabilities affecting WordPress Core. Continuously updated with verified security disclosures, including severity, impact, and affected versions.

2017201820192020202120222023202420252026

Critical

High

Medium

Low

Filters

None active

Risk Level

Date Range (Last)

Vulnerability Records

381 records


2026-08-12 00:00	WordPress Core <= 7.0.3 - Authenticated (Author+) Remote Code Execution via Malicious File Upload WordPress 7.0 4.7.0 – 7.0.3 · 24 branches	`CVE-2026-65640`	8.8 High	pwn.ai Team	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery WordPress 7.0 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.8 Medium	Andrew MacPherson	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass WordPress 7.0 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.3 Medium	0ways	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection WordPress 7.0 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.5 Medium	Anonymous	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds WordPress 7.0 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.3 Medium	Elio Gubser (odkdn1)	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit WordPress 7.0 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.9 Medium	moochi	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite WordPress 7.0 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.3 Medium	Aikido Security	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element WordPress 7.0 4.7.0 – 7.0.2 · 24 branches	`N/A`	6.4 Medium	Asaf Mozes	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Reflected Cross-Site Scripting via log Parameter WordPress 7.0 4.7.0 – 7.0.2 · 24 branches	`CVE-2026-64638`	6.1 Medium	pwn.ai Team	Yes
2026-07-17 00:00	WordPress Core 6.8 - 7.0.1 - Unauthenticated SQL Injection via author__not_in Parameter WordPress 7.0 6.8 – < 7.0.2 · 3 branches	`CVE-2026-60137`	7.5 High	Tin Pham (TF1T)	Yes

Showing 1–10 of 381 reports

All WordPress Core

Every core with a recorded vulnerability: 792 in total.Page 1 of 4.