WordPress
CVEs currently on EVULNABLE's Priority Feed for WordPress, and this vendor's own CISA KEV history.
CISA KEV additions over time
Weekly additions to the KEV catalog, last 26 weeks. Ransomware-linked additions are the base of each bar. Ransomware-linked as currently marked by CISA; recent weeks can rise as CISA updates entries.
20 Apr – 12 Oct; busiest week: 2 added.
- Not ransomware-linked
- Ransomware-linked
- This week (so far)
| Week of | Added to KEV | Ransomware-linked |
|---|---|---|
| 2026-04-20 | 0 | 0 |
| 2026-04-27 | 0 | 0 |
| 2026-05-04 | 0 | 0 |
| 2026-05-11 | 0 | 0 |
| 2026-05-18 | 0 | 0 |
| 2026-05-25 | 0 | 0 |
| 2026-06-01 | 0 | 0 |
| 2026-06-08 | 0 | 0 |
| 2026-06-15 | 0 | 0 |
| 2026-06-22 | 0 | 0 |
| 2026-06-29 | 0 | 0 |
| 2026-07-06 | 0 | 0 |
| 2026-07-13 | 0 | 0 |
| 2026-07-20 | 2 | 0 |
| 2026-07-27 | 0 | 0 |
| 2026-08-03 | 0 | 0 |
| 2026-08-10 | 0 | 0 |
| 2026-08-17 | 0 | 0 |
| 2026-08-24 | 0 | 0 |
| 2026-08-31 | 0 | 0 |
| 2026-09-07 | 0 | 0 |
| 2026-09-14 | 0 | 0 |
| 2026-09-21 | 1 | 0 |
| 2026-09-28 | 0 | 0 |
| 2026-10-05 | 0 | 0 |
| 2026-10-12 (so far) | 0 | 0 |
In EVULNABLE's ranked feed
Showing all 6 WordPress CVEs in EVULNABLE's ranked feed.
#1 86 Immediate CVE-2020-25213 ExigentKEV since 2021 · listed over a yearCISA KEV WordPress — WordPress File Manager Plugin Remote Code Execution Vulnerability KEV, EPSS 97.3%
EVRS 86/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.973.
#2 83 Urgent CVE-2020-11738 KEV since 2021 · listed over a yearCISA KEV WordPress — WordPress Snap Creek Duplicator Plugin File Download Vulnerability KEV, EPSS 97.8%
EVRS 83/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.978.
#3 75 Urgent CVE-2019-9978 KEV since 2021 · listed over a yearCISA KEV WordPress — WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability KEV, EPSS 72.9%
EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.729.
#4 75 Urgent CVE-2026-87902 CISA federal deadline · Overdue by 18 daysCISA KEV WordPress — WordPress Core Remote File Inclusion Vulnerability KEV, EPSS 40.0%, added to KEV within the last 30 days
EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.400.
#5 75 Urgent CVE-2026-63030 CISA federal deadline · Overdue by 3 monthsCISA KEV WordPress — WordPress Core Interpretation Conflict Vulnerability KEV, EPSS 10.6%, added to KEV within the last 90 days
EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.106.
#6 75 Urgent CVE-2026-60137 CISA federal deadline · Overdue by 2 monthsCISA KEV WordPress — WordPress Core SQL Injection Vulnerability KEV, EPSS 5.3%, added to KEV within the last 90 days
EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.
Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.053.