WordPress 6.4.7

WordPress 6.4.7 has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2026; all 9 are fixed as of August 2026. Their average CVSS score is 5.1, and the most serious one scores 6.4 out of 10. 2026 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (33%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Injection.

Every one of the 9 issues recorded for WordPress 6.4.7 has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

5.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WordPress 6.4.7 vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element

Read the full analysis

Vulnerability Records

9 records


2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds WordPress 6.4.7 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.3 Medium	Elio Gubser (odkdn1)	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery WordPress 6.4.7 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.8 Medium	Andrew MacPherson	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection WordPress 6.4.7 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.5 Medium	Anonymous	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass WordPress 6.4.7 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.3 Medium	0ways	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit WordPress 6.4.7 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.9 Medium	moochi	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite WordPress 6.4.7 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.3 Medium	Aikido Security	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Reflected Cross-Site Scripting via log Parameter WordPress 6.4.7 4.7.0 – 7.0.2 · 24 branches	`CVE-2026-64638`	6.1 Medium	pwn.ai Team	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element WordPress 6.4.7 4.7.0 – 7.0.2 · 24 branches	`N/A`	6.4 Medium	Asaf Mozes	Yes
2012-06-20 00:00	WordPress Core - Informational < 6.8 - Weak Hashing Algorithm WordPress 6.4.7 < 6.8	`CVE-2012-6707`	3.7 Low	Anonymous	Yes

Showing 1–9 of 9 reports