Home / CVEs

Exploited vulnerabilities (CISA KEV)

CVEs with exploitation confirmed by CISA (Known Exploited Vulnerabilities), with required actions and deadlines.

4 result(s)

Export this search: RSS · CSV · STIX

CVE-2026-87902 High · 8.1 KEV Urgent · 74 Public exploit CWE-98 Sep 22, 2026

WordPress Core Remote File Inclusion Vulnerability

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

CVE-2026-63030 Critical · 9.8 KEV Urgent · 82 Public exploit CWE-436 Jul 17, 2026

WordPress Core Interpretation Conflict Vulnerability

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

CVE-2026-60137 Medium · 5.9 KEV Urgent · 70 Public exploit CWE-89 Jul 17, 2026

WordPress Core SQL Injection Vulnerability

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

CVE-2016-10033 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-88 Dec 30, 2016

PHPMailer Command Injection Vulnerability

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.