WordPress
6 WordPress flaws are on CISA's list of vulnerabilities attackers have used, 3 of them added in 2026. The latest was added Sep 25, 2026.
6on CISA's list, all time
3added in 2026
1in the last 90 days
0used by ransomware
3zero-days, all time
Exploited flaws added each year
Most-hit products
| Product | Exploited flaws | Most recent |
|---|---|---|
| Core | 3 | Sep 25, 2026 |
| Social Warfare Plugin | 1 | Nov 3, 2021 |
| Snap Creek Duplicator Plugin | 1 | Nov 3, 2021 |
| File Manager Plugin | 1 | Nov 3, 2021 |
Latest WordPress flaws
- CoreWordPress Core Remote File Inclusion Vulnerability
- CoreWordPress Core SQL Injection Vulnerability
- CoreWordPress Core Interpretation Conflict Vulnerability
- Social Warfare PluginWordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
- Snap Creek Duplicator PluginWordPress Snap Creek Duplicator Plugin File Download Vulnerability
- File Manager PluginWordPress File Manager Plugin Remote Code Execution Vulnerability
Counts come from CISA's Known Exploited Vulnerabilities catalog, which lists flaws with reliable evidence of real attacks. A higher count often reflects how widely a vendor's products are used and targeted, not only how secure they are.