WO
CMS
WordPress
On CISA KEVExploited in the wild
369
CVEs
7
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 20High 48Medium 105Low 3
Watch
Add WordPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-54352 | 3.7 | Jul 21 | WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests Affected: 3.5 through 6.8.2 |
| CVE-2020-4050 | 3.1 | Jun 12 | In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fields to be saved Affected: 3.7 before 3.7.34; 3.8 before 3.8.34; 3.9 before 3.9.32; 4.0 before 4.0.31; 4.1 before 4.1.31; 4.2 before 4.2.28; +12 more |
| CVE-2020-4049 | 2.4 | Jun 12 | In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes… Affected: 3.7 before 3.7.34; 3.8 before 3.8.34; 3.9 before 3.9.32; 4.0 before 4.0.31; 4.1 before 4.1.31; 4.2 before 4.2.28; +12 more |
Showing 3