https://patchfirst.co/vendor/wordpress/New and newly exploited WordPress CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 13:00:36 GMThttps://patchfirst.co/cve/CVE-2026-87902/CVE-2026-87902#kevFri, 25 Sep 2026 00:00:00 GMTWordPress · Core. In CISA KEV since 2026-09-25. ENISA EUVD lists it as exploited. EPSS 95.8% (higher than 99.87% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.6 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2026-63030/CVE-2026-63030#kevTue, 21 Jul 2026 00:00:00 GMTWordPress · Core. In CISA KEV since 2026-07-21. ENISA EUVD lists it as exploited. EPSS 10.6% (higher than 95.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 77.9 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2026-60137/CVE-2026-60137#kevTue, 21 Jul 2026 00:00:00 GMTWordPress · Core. In CISA KEV since 2026-07-21. ENISA EUVD lists it as exploited. EPSS 5.3% (higher than 92.6% of CVEs). CVSS 5.9 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Named in 1 threat report. Priority 74.5 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2022-3590/CVE-2022-3590Wed, 14 Dec 2022 00:00:00 GMTWordPress · WordPress. Not in CISA KEV. EPSS 3.4% (higher than 88.9% of CVEs). CVSS 5.9 MEDIUM. Public exploit code exists. Priority 63.8 of 100.public-exploithttps://patchfirst.co/cve/CVE-2022-21661/CVE-2022-21661Thu, 06 Jan 2022 00:00:00 GMTWordPress · wordpress-develop. Not in CISA KEV. EPSS 97.8% (higher than 99.91% of CVEs). CVSS 8.0 HIGH. Public exploit code exists. Priority 67.2 of 100.public-exploithttps://patchfirst.co/cve/CVE-2022-21662/CVE-2022-21662Thu, 06 Jan 2022 00:00:00 GMTWordPress · wordpress-develop. Not in CISA KEV. EPSS 64.5% (higher than 99.24% of CVEs). CVSS 8.0 HIGH. Priority 61.8 of 100.https://patchfirst.co/cve/CVE-2020-25213/CVE-2020-25213#kevWed, 03 Nov 2021 00:00:00 GMTWordPress · File Manager Plugin. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 97.3% (higher than 99.9% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2020-11738/CVE-2020-11738#kevWed, 03 Nov 2021 00:00:00 GMTWordPress · Snap Creek Duplicator Plugin. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 97.8% (higher than 99.91% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1005 Data from Local System; T1190 Exploit Public-Facing Application. Priority 68.2 of 100.kevpublic-exploitT1005T1190https://patchfirst.co/cve/CVE-2019-9978/CVE-2019-9978#kevWed, 03 Nov 2021 00:00:00 GMTWordPress · Social Warfare Plugin. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 72.9% (higher than 99.45% of CVEs). CVSS 6.1 MEDIUM. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1189 Drive-by Compromise. Priority 67.2 of 100.kevpublic-exploitT1059T1189https://patchfirst.co/cve/CVE-2021-29476/CVE-2021-29476Tue, 27 Apr 2021 00:00:00 GMTWordPress · Requests. Not in CISA KEV. EPSS 2.1% (higher than 82% of CVEs). CVSS 9.8 CRITICAL. Priority 58.3 of 100.https://patchfirst.co/cve/CVE-2021-29447/CVE-2021-29447Thu, 15 Apr 2021 00:00:00 GMTWordPress · wordpress-develop. Not in CISA KEV. EPSS 85.7% (higher than 99.73% of CVEs). CVSS 7.1 HIGH. Public exploit code exists. Priority 31.3 of 100.public-exploithttps://patchfirst.co/cve/CVE-2020-11030/CVE-2020-11030Thu, 30 Apr 2020 00:00:00 GMTWordPress · WordPress. Not in CISA KEV. EPSS 1.4% (higher than 73.1% of CVEs). CVSS 6.4 MEDIUM. ATT&CK: T1059.007 JavaScript; T1557 Adversary-in-the-Middle. Priority 19.1 of 100.T1059.007T1557