{"meta":{"title":"KEV entries: WordPress","description":"All KEV entries for vendor WordPress.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":5,"vendor":"WordPress","entries":5,"shareOfCatalogPercent":0.3,"ransomwareKnown":0,"firstDateAdded":"2021-11-03","latestDateAdded":"2026-07-21","rank":51},"data":[{"cveID":"CVE-2026-63030","vendorProject":"WordPress","product":"Core","vulnerabilityName":"WordPress Core Interpretation Conflict Vulnerability","dateAdded":"2026-07-21","dueDate":"2026-07-24","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-436"],"shortDescription":"WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63030","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-63030/"},{"cveID":"CVE-2026-60137","vendorProject":"WordPress","product":"Core","vulnerabilityName":"WordPress Core SQL Injection Vulnerability","dateAdded":"2026-07-21","dueDate":"2026-08-04","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-89"],"shortDescription":"WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-60137","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-60137/"},{"cveID":"CVE-2020-25213","vendorProject":"WordPress","product":"File Manager Plugin","vulnerabilityName":"WordPress File Manager Plugin Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-434"],"shortDescription":"WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-25213","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-25213"},{"cveID":"CVE-2020-11738","vendorProject":"WordPress","product":"Snap Creek Duplicator Plugin","vulnerabilityName":"WordPress Snap Creek Duplicator Plugin File Download Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-22"],"shortDescription":"WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-11738","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-11738"},{"cveID":"CVE-2019-9978","vendorProject":"WordPress","product":"Social Warfare Plugin","vulnerabilityName":"WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-79"],"shortDescription":"WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-9978","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-9978"}]}