{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: WordPress vulnerabilities","home_page_url":"https://patchfirst.co/vendor/wordpress/","feed_url":"https://patchfirst.co/feed/vendor/wordpress.json","description":"New and newly exploited WordPress CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-87902#kev","url":"https://patchfirst.co/cve/CVE-2026-87902/","title":"[KEV] CVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability","content_text":"WordPress · Core. In CISA KEV since 2026-09-25. ENISA EUVD lists it as exploited. EPSS 95.8% (higher than 99.87% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.6 of 100.","summary":"WordPress Core Remote File Inclusion Vulnerability","date_published":"2026-09-25T00:00:00.000Z","date_modified":"2026-09-28T12:20:54.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":78.6,"kev":{"dateAdded":"2026-09-25","ransomware":false},"epss":{"score":0.95769,"percentile":0.99872},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1"},"vendor":"WordPress","product":"Core","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-63030#kev","url":"https://patchfirst.co/cve/CVE-2026-63030/","title":"[KEV] CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability","content_text":"WordPress · Core. In CISA KEV since 2026-07-21. ENISA EUVD lists it as exploited. EPSS 10.6% (higher than 95.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 77.9 of 100.","summary":"WordPress Core Interpretation Conflict Vulnerability","date_published":"2026-07-21T00:00:00.000Z","date_modified":"2026-10-08T10:35:50.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":77.9,"kev":{"dateAdded":"2026-07-21","ransomware":false},"epss":{"score":0.10649,"percentile":0.95791},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"WordPress","product":"Core","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-60137#kev","url":"https://patchfirst.co/cve/CVE-2026-60137/","title":"[KEV] CVE-2026-60137: WordPress Core SQL Injection Vulnerability","content_text":"WordPress · Core. In CISA KEV since 2026-07-21. ENISA EUVD lists it as exploited. EPSS 5.3% (higher than 92.6% of CVEs). CVSS 5.9 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Named in 1 threat report. Priority 74.5 of 100.","summary":"WordPress Core SQL Injection Vulnerability","date_published":"2026-07-21T00:00:00.000Z","date_modified":"2026-10-08T10:35:47.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":74.5,"kev":{"dateAdded":"2026-07-21","ransomware":false},"epss":{"score":0.05323,"percentile":0.92598},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1"},"vendor":"WordPress","product":"Core","techniqueIds":["T1190","T1005"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2022-3590","url":"https://patchfirst.co/cve/CVE-2022-3590/","title":"CVE-2022-3590: WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding","content_text":"WordPress · WordPress. Not in CISA KEV. EPSS 3.4% (higher than 88.9% of CVEs). CVSS 5.9 MEDIUM. Public exploit code exists. Priority 63.8 of 100.","summary":"WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding","date_published":"2022-12-14T00:00:00.000Z","date_modified":"2025-04-21T14:12:02.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":63.8,"kev":null,"epss":{"score":0.03434,"percentile":0.88939},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1"},"vendor":"WordPress","product":"WordPress","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-21661","url":"https://patchfirst.co/cve/CVE-2022-21661/","title":"CVE-2022-21661: SQL injection in WordPress","content_text":"WordPress · wordpress-develop. Not in CISA KEV. EPSS 97.8% (higher than 99.91% of CVEs). CVSS 8.0 HIGH. Public exploit code exists. Priority 67.2 of 100.","summary":"SQL injection in WordPress","date_published":"2022-01-06T00:00:00.000Z","date_modified":"2024-09-09T14:13:15.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":67.2,"kev":null,"epss":{"score":0.97795,"percentile":0.99905},"cvss":{"score":8,"severity":"HIGH","version":"3.1"},"vendor":"WordPress","product":"wordpress-develop","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-21662","url":"https://patchfirst.co/cve/CVE-2022-21662/","title":"CVE-2022-21662: Stored XSS in WordPress","content_text":"WordPress · wordpress-develop. Not in CISA KEV. EPSS 64.5% (higher than 99.24% of CVEs). CVSS 8.0 HIGH. Priority 61.8 of 100.","summary":"Stored XSS in WordPress","date_published":"2022-01-06T00:00:00.000Z","date_modified":"2025-04-23T19:14:24.000Z","tags":[],"_patchfirst":{"reason":"published","priority":61.8,"kev":null,"epss":{"score":0.64529,"percentile":0.99237},"cvss":{"score":8,"severity":"HIGH","version":"3.1"},"vendor":"WordPress","product":"wordpress-develop","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-25213#kev","url":"https://patchfirst.co/cve/CVE-2020-25213/","title":"[KEV] CVE-2020-25213: WordPress File Manager Plugin Remote Code Execution Vulnerability","content_text":"WordPress · File Manager Plugin. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 97.3% (higher than 99.9% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"WordPress File Manager Plugin Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:06:35.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.97328,"percentile":0.99897},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"WordPress","product":"File Manager Plugin","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-11738#kev","url":"https://patchfirst.co/cve/CVE-2020-11738/","title":"[KEV] CVE-2020-11738: WordPress Snap Creek Duplicator Plugin File Download Vulnerability","content_text":"WordPress · Snap Creek Duplicator Plugin. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 97.8% (higher than 99.91% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1005 Data from Local System; T1190 Exploit Public-Facing Application. Priority 68.2 of 100.","summary":"WordPress Snap Creek Duplicator Plugin File Download Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:50:42.000Z","tags":["kev","public-exploit","T1005","T1190"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.97822,"percentile":0.99906},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"WordPress","product":"Snap Creek Duplicator Plugin","techniqueIds":["T1005","T1190"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-9978#kev","url":"https://patchfirst.co/cve/CVE-2019-9978/","title":"[KEV] CVE-2019-9978: WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability","content_text":"WordPress · Social Warfare Plugin. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 72.9% (higher than 99.45% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1189 Drive-by Compromise. Priority 67.2 of 100.","summary":"WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:44:58.000Z","tags":["kev","public-exploit","T1059","T1189"],"_patchfirst":{"reason":"kev","priority":67.2,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.72946,"percentile":0.99451},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1"},"vendor":"WordPress","product":"Social Warfare Plugin","techniqueIds":["T1059","T1189"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-29476","url":"https://patchfirst.co/cve/CVE-2021-29476/","title":"CVE-2021-29476: Insecure Deserialization of untrusted data in rmccue/requests","content_text":"WordPress · Requests. Not in CISA KEV. EPSS 2.1% (higher than 82% of CVEs). CVSS 9.8 CRITICAL. Priority 58.3 of 100.","summary":"Insecure Deserialization of untrusted data in rmccue/requests","date_published":"2021-04-27T00:00:00.000Z","date_modified":"2024-08-03T22:11:05.000Z","tags":[],"_patchfirst":{"reason":"published","priority":58.3,"kev":null,"epss":{"score":0.02142,"percentile":0.82034},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"WordPress","product":"Requests","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-29447","url":"https://patchfirst.co/cve/CVE-2021-29447/","title":"CVE-2021-29447: WordPress Authenticated XXE attack when installation is running PHP 8","content_text":"WordPress · wordpress-develop. Not in CISA KEV. EPSS 85.7% (higher than 99.73% of CVEs). CVSS 7.1 HIGH. Public exploit code exists. Priority 31.3 of 100.","summary":"WordPress Authenticated XXE attack when installation is running PHP 8","date_published":"2021-04-15T00:00:00.000Z","date_modified":"2024-08-03T22:02:51.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":31.3,"kev":null,"epss":{"score":0.85719,"percentile":0.99726},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1"},"vendor":"WordPress","product":"wordpress-develop","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2020-11030","url":"https://patchfirst.co/cve/CVE-2020-11030/","title":"CVE-2020-11030: Cross-site scripting (XSS) in Search block in WordPress","content_text":"WordPress · WordPress. Not in CISA KEV. EPSS 1.4% (higher than 73.1% of CVEs). CVSS 6.4 MEDIUM. ATT&CK: T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 19.1 of 100.","summary":"Cross-site scripting (XSS) in Search block in WordPress","date_published":"2020-04-30T00:00:00.000Z","date_modified":"2024-08-04T11:21:14.000Z","tags":["T1059.007","T1557"],"_patchfirst":{"reason":"published","priority":19.1,"kev":null,"epss":{"score":0.01437,"percentile":0.73113},"cvss":{"score":6.4,"severity":"MEDIUM","version":"3.1"},"vendor":"WordPress","product":"WordPress","techniqueIds":["T1059.007","T1557"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}