WordPress 6.0.12

WordPress 6.0.12 has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2026; all 10 are fixed as of August 2026. Their average CVSS score is 5.2, and the most serious one scores 6.4 out of 10. 2026 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (30%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Injection.

Every one of the 10 issues recorded for WordPress 6.0.12 has a vendor fix available, so running the current release closes all known holes.

8 independent researchers contributed these findings, one record each.

01234567891020.06.2012Today20.06.20123.7WordPress Core - Informational < 6.8 - Weak Hashing Algorithm CVSS 3.7 · 20.06.201204.04.20245.3WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink CVSS 5.3 · 04.04.202408.08.20265.3WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds CVSS 5.3 · 08.08.20265.8WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery CVSS 5.8 · 08.08.20265.5WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection CVSS 5.5 · 08.08.20264.3WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass CVSS 4.3 · 08.08.20264.9WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit CVSS 4.9 · 08.08.20264.3WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite CVSS 4.3 · 08.08.20266.1WordPress Core <= 7.0.2 - Unauthenticated Reflected Cross-Site Scripting via log Parameter CVSS 6.1 · 08.08.20266.4WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element CVSS 6.4 · 08.08.2026

Strategic Overview

Avg CVSSMedium
5.2/ 10
Patch Coverage100%
Open

0

Fixed

10

Get automatic notifications for all WordPress 6.0.12 vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element

Read the full analysis

Vulnerability Records

10 records
2026-08-08 00:00
WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds
WordPress 6.0.12
4.7.0 – 7.0.2 · 24 branches
N/A
5.3
Medium
Elio Gubser (odkdn1)Yes
2026-08-08 00:00
WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery
WordPress 6.0.12
4.7.0 – 7.0.2 · 24 branches
N/A
5.8
Medium
Andrew MacPhersonYes
2026-08-08 00:00
WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection
WordPress 6.0.12
4.7.0 – 7.0.2 · 24 branches
N/A
5.5
Medium
AnonymousYes
2026-08-08 00:00
WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass
WordPress 6.0.12
4.7.0 – 7.0.2 · 24 branches
N/A
4.3
Medium
0waysYes
2026-08-08 00:00
WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
WordPress 6.0.12
4.7.0 – 7.0.2 · 24 branches
N/A
4.9
Medium
moochiYes
2026-08-08 00:00
WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite
WordPress 6.0.12
4.7.0 – 7.0.2 · 24 branches
N/A
4.3
Medium
Aikido SecurityYes
2026-08-08 00:00
WordPress Core <= 7.0.2 - Unauthenticated Reflected Cross-Site Scripting via log Parameter
WordPress 6.0.12
4.7.0 – 7.0.2 · 24 branches
CVE-2026-64638
6.1
Medium
pwn.ai TeamYes
2026-08-08 00:00
WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element
WordPress 6.0.12
4.7.0 – 7.0.2 · 24 branches
N/A
6.4
Medium
Asaf MozesYes
2024-04-04 00:00
WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink
WordPress 6.0.12
<= 6.4.3
CVE-2023-5692
5.3
Medium
Francesco CarlucciYes
2012-06-20 00:00
WordPress Core - Informational < 6.8 - Weak Hashing Algorithm
WordPress 6.0.12
< 6.8
CVE-2012-6707
3.7
Low
AnonymousYes
Showing 1–10 of 10 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C