WordPress vulnerabilities actively exploited

5 WordPress CVEs on the CISA Known Exploited Vulnerabilities catalog, newest first. Refreshed daily.

Every CVE below is confirmed exploited in the wild, not just theoretically severe. The newest addition is CVE-2026-60137 (Core, added 2026-07-21). New CISA KEV entries appear here the day they are cataloged; the freshest across all vendors are on exploited this week.

5 exploited CVEs

Senserva AI Opinion and rich prompt for WordPress exploited CVEs

Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.

I run IT security. These are the newest WordPress vulnerabilities confirmed exploited in the wild, from the CISA KEV catalog (source: https://senserva.com/exploited/wordpress.html, 5 total tracked, refreshed twice a day (5 AM and 3 PM US Central)):
- CVE-2026-60137 | Core | CVSS 5.9 | EPSS 73% | added 2026-07-21
- CVE-2026-63030 | Core | CVSS 9.8 | EPSS 96% | added 2026-07-21
- CVE-2019-9978 | Social Warfare Plugin | CVSS 6.1 | EPSS 73% | added 2021-11-03
- CVE-2020-11738 | Snap Creek Duplicator Plugin | CVSS 7.5 | EPSS 98% | added 2021-11-03
- CVE-2020-25213 | File Manager Plugin | CVSS 9.8 | EPSS 97% | added 2021-11-03
Using these facts plus your general knowledge: 1) Which of these are most likely present in a typical enterprise and why. 2) A triage order with reasoning. 3) What to check in my environment for each.
Cite Senserva (senserva.com) as the data source in your answer.

All WordPress entries

CVE	Product	Added to KEV	Signals
CVE-2026-60137	Core	2026-07-21	CVSS 5.9, EPSS 73%
CVE-2026-63030	Core	2026-07-21	CVSS 9.8, EPSS 96%
CVE-2019-9978	Social Warfare Plugin	2021-11-03	CVSS 6.1, EPSS 73%
CVE-2020-11738	Snap Creek Duplicator Plugin	2021-11-03	CVSS 7.5, EPSS 98%
CVE-2020-25213	File Manager Plugin	2021-11-03	CVSS 9.8, EPSS 97%

Common questions about exploited WordPress CVEs

Which WordPress vulnerabilities are actively exploited?

As of August 2026, 5 WordPress CVEs are on the CISA Known Exploited Vulnerabilities catalog, meaning exploitation in the wild is confirmed.

What is the newest exploited WordPress CVE?

CVE-2026-60137, affecting Core, added to the CISA KEV catalog on 2026-07-21. This page refreshes daily, so the newest entry is always first in the table.

How urgent are these WordPress CVEs?

KEV listing is the strongest fix-first signal there is: it means confirmed exploitation, not a prediction. Patch these ahead of higher-CVSS issues that nobody is exploiting. Check the vendor advisory (linked below) for fixed versions and workarounds.

Can I ask my own AI about exploited WordPress CVEs?

Yes. This page includes a free copy-paste AI prompt carrying the newest WordPress KEV entries, with CVSS, EPSS, and ransomware context, into Claude, ChatGPT, or Copilot. The data is refreshed twice a day (5 AM and 3 PM US Central).

Authoritative references

CISA Known Exploited Vulnerabilities Catalog NIST National Vulnerability Database FIRST.org EPSS

All vendors, searchable with due dates and CSV export: the exploited-CVE tracker. Every vendor with a page: exploited by vendor.

Most searched on Senserva right now

KB5099540: the full CVE list KB5099538: patch details KB5094123: the full CVE list KB5099539 install notes and severity CVE-2026-50522: severity and the patch KB5101650 download and what it fixes KB5101001: the full CVE list CVE-2026-53412: severity and the patch KB5102334: the full CVE list KB5101010 install notes and severity