WordPress Core

Browse known vulnerabilities affecting WordPress Core. Continuously updated with verified security disclosures, including severity, impact, and affected versions.

2017201820192020202120222023202420252026

Critical

High

Medium

Low

Filters

None active

Risk Level

Date Range (Last)

Vulnerability Records

400 records


2026-10-07 00:00	WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type WordPress 7.1 4.7.0 – 7.1.2 · 25 branches	`N/A`	3.3 Low	Alex Concha	Yes
2026-10-07 00:00	WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Denial of Service via Block Editor URL Details WordPress 7.1 4.7.0 – 7.1.2 · 25 branches	`N/A`	4.3 Medium	Anthropic	Yes
2026-10-07 00:00	WordPress Core 4.7.0 - 7.1.2 - Authenticated (Author+) Unauthorized Sticky Post Modification via REST API WordPress 7.1 4.7.0 – 7.1.2 · 25 branches	`N/A`	4.3 Medium	Anthropic	Yes
2026-10-07 00:00	WordPress Core 6.5.0 - 7.1.2 - Authenticated (Author+) Second-Order SQL Injection via WXR Export WordPress 7.1 6.5.0 – 7.1.2 · 7 branches	`N/A`	4.8 Medium	Anthropic	Yes
2026-10-07 00:00	WordPress Core 4.7.0 - 7.1.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds WordPress 7.1 4.7.0 – 7.1.2 · 25 branches	`CVE-2026-66666`	5.3 Medium	Ananda Dhakal	Yes
2026-10-07 00:00	WordPress Core 4.7.0 - 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Imgur oEmbed WordPress 7.1 4.7.0 – 7.1.2 · 25 branches	`N/A`	6.4 Medium	Zhengyu Liu	Yes
2026-10-06 00:00	WordPress Core 7.1 - 7.1.2 - Unauthenticated Stored Cross-Site Scripting via Pending Comments WordPress 7.1 7.1.0 – 7.1.2	`N/A`	7.2 High	Thomas Chauchefoin	Yes
2026-09-22 00:00	WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal WordPress 7.1 4.7 – 7.1.1 · 25 branches	`CVE-2026-87902`	8.1 High	Robert Ressl	Yes
2026-09-17 00:00	WordPress Core <= 7.1 - Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite) WordPress 7.1 6.6.7 – 7.1 · 6 branches	`N/A`	2.7 Low	Jesse McNeil	Yes
2026-09-17 00:00	WordPress Core <= 7.1 - HTML API set_modifiable_text() Comment Boundary Break WordPress 7.1 6.7 – 7.1 · 5 branches	`N/A`	3.7 Low	Jeremy Felt	Yes

Showing 1–10 of 400 reports

All WordPress Core

Every core with a recorded vulnerability: 868 in total.Page 1 of 5.