ZeusQA
Start free

Known exploited vulnerabilities

WordPress vulnerabilities attackers have used

Every WordPress vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 7 WordPress vulnerabilities as exploited in the wild, 4 of them added in the last 12 months. The most recent is CVE-2026-119977, added Nov 3, 2026. Core has the most entries (3).

In KEV, all time
7
Added, last 12 months
4
Used in ransomware
0
New CVEs this week
0

By product

Core (3), File Manager Plugin (1), Snap Creek Duplicator Plugin (1), Social Warfare Plugin (1), WordPress Core (1).

Every WordPress entry in CISA KEV

  1. CVE-2026-119977

    Added · due

    WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

    WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable…

  2. CVE-2026-87902

    Added · due

    WordPress Core Remote File Inclusion Vulnerability

    WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to…

  3. CVE-2026-63030

    Added · due

    WordPress Core Interpretation Conflict Vulnerability

    WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.

  4. CVE-2026-60137

    Added · due

    WordPress Core SQL Injection Vulnerability

    WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution…

  5. CVE-2020-25213

    Added · due

    WordPress File Manager Plugin Remote Code Execution Vulnerability

    WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.

  6. CVE-2020-11738

    Added · due

    WordPress Snap Creek Duplicator Plugin File Download Vulnerability

    WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability…

  7. CVE-2019-9978

    Added · due

    WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability

    WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works