Vulnerability Overview
Exploitation Activity
Exploitation Intelligence
On September 22, 2026, WordPress released version 7.1.2 to address a critical unauthenticated path traversal vulnerability tracked as CVE-2026-87902. This flaw allows unauthenticated attackers to include local PHP files from outside the active theme directories, potentially leading to remote code ex...
A vulnerability in WordPress, identified as CVE-2026-64638, allows remote code execution via a pre-authentication cross-site scripting (XSS) attack. Disclosed by pwn.ai in August 2026, the flaw affects all versions of WordPress Core, impacting over 500 million websites. The vulnerability arises from...
A critical vulnerability in WordPress, tracked as CVE-2026-93485, allows unauthenticated users to execute remote code on servers through a crafted comment. This flaw, dubbed 'Comment2Shell,' enables attackers to insert malicious scripts that execute when a logged-in administrator views the comment....
WordPress has released version 7.0.3, which includes several security fixes. Users are urged to update immediately to mitigate risks associated with stored cross-site scripting (XSS) vulnerabilities and privilege escalation issues. Notable vulnerabilities include pre-auth reflected XSS on the login...
