WordPress 6.8.6

WordPress 6.8.6 has 8 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 8 are fixed as of August 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10. 2026 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (38%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Injection.

Every one of the 8 issues recorded for WordPress 6.8.6 has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

5.3/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WordPress 6.8.6 vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4

WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element

Read the full analysis

Vulnerability Records

8 records


2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Sensitive Information Exposure via Comment Feeds WordPress 6.8.6 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.3 Medium	Elio Gubser (odkdn1)	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Blind Server-Side Request Forgery WordPress 6.8.6 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.8 Medium	Andrew MacPherson	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Author+) CSS Injection WordPress 6.8.6 4.7.0 – 7.0.2 · 24 branches	`N/A`	5.5 Medium	Anonymous	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Email Change Confirmation Bypass WordPress 6.8.6 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.3 Medium	0ways	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit WordPress 6.8.6 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.9 Medium	moochi	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Site Creation on Multisite WordPress 6.8.6 4.7.0 – 7.0.2 · 24 branches	`N/A`	4.3 Medium	Aikido Security	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Unauthenticated Reflected Cross-Site Scripting via log Parameter WordPress 6.8.6 4.7.0 – 7.0.2 · 24 branches	`CVE-2026-64638`	6.1 Medium	pwn.ai Team	Yes
2026-08-08 00:00	WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Emoji Settings Element WordPress 6.8.6 4.7.0 – 7.0.2 · 24 branches	`N/A`	6.4 Medium	Asaf Mozes	Yes

Showing 1–8 of 8 reports