11,800 WordPress CVEs, 7 in CISA KEV: the plugins attackers actually use
Every WordPress core, plugin and theme advisory in our feed, ranked by real exploitation (CISA KEV + EPSS). The plugins with the most advisories are not the ones being attacked; the ones being attacked are backup, file-manager and form plugins with unauthenticated upload or RCE bugs.
What the feed covers
12,328 advisories against 11,795 distinct CVEs: WordPress core, 11,818 plugin advisories and 165 theme advisories, from NVD and Wordfence data.
The plugins with the most advisories are not the ones being attacked
If you sorted by advisory count you would worry about these ten. The second column is the highest EPSS any of their CVEs reaches.
royal-elementor-addons peaks at 86%; ninja-forms peaks at 62%; easy-digital-downloads peaks at 11%; download-manager peaks at 11%; ultimate-member peaks at 89%; photo-gallery peaks at 75%. Volume of advisories measures how much a plugin gets audited, not how much it gets exploited.
The 7 WordPress CVEs in CISA KEV
Confirmed exploited in the wild. 6 plugins, 2 core. Pattern: unauthenticated file upload or RCE in backup, file-manager and form plugins — the kind of bug a scanner can exploit without an account.
| Component | CVE | What | Severity | EPSS | Fixed in |
|---|---|---|---|---|---|
| duplicator (WordPress plugin) | CVE-2020-11738 KEV | The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) all | high 7.5 | 98% | 3.8.7.1 |
| wp-file-manager (WordPress plugin) | CVE-2020-25213 KEV | Unauthenticated arbitrary file upload to RCE via the elFinder connector | critical 10.0 | 97% | 6.9 |
| contact-form-7 (WordPress plugin) | CVE-2020-35489 KEV | Unrestricted file upload via unsanitised filenames (double extension) | critical 10.0 | 89% | 5.3.2 |
| social-warfare (WordPress plugin) | CVE-2019-9978 KEV | The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php? | medium 6.1 | 73% | 3.5.3 |
| social-warfare-pro (WordPress plugin) | CVE-2019-9978 KEV | The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php? | medium 6.1 | 73% | 3.5.3 |
| litespeed-cache (WordPress plugin) | CVE-2024-28000 KEV | Unauthenticated privilege escalation to administrator via weak hash in the crawler | critical 9.8 | 68% | 6.4 |
| WordPress core | CVE-2026-63030 KEV | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route c | critical 9.8 | 11% | 6.9.5, 7.0.2 |
| WordPress core | CVE-2026-60137 KEV | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise | medium 5.9 | 5% | 6.8.6, 6.9.5, 7.0.2 |
Exploited but not in KEV: EPSS ≥ 50%
151 WordPress CVEs have at least a 50% probability of exploitation in the next 30 days; 551 are above 10%. KEV lists 7. If your tooling only knows KEV, it is blind to most of the active attack surface on WordPress. The top 15 that are not in KEV:
| Component | CVE | What | Severity | EPSS | Fixed in |
|---|---|---|---|---|---|
| backup-backup (WordPress plugin) | CVE-2023-6553 | The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up | critical 9.8 | 98% | — |
| WordPress core | CVE-2022-21661 | WordPress is a free and open-source content management system written in PHP and paired with a Maria | high 8.0 | 98% | 3.7.37, 3.8.37, 3.9.35 |
| chop-slider (WordPress plugin) | CVE-2020-11530 | A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerabili | critical 9.8 | 95% | — |
| wpdiscuz (WordPress plugin) | CVE-2020-24186 | A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for W | critical 10.0 | 95% | — |
| payment-form-for-paypal-pro (WordPress plugin) | CVE-2020-14092 | The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection. | critical 9.8 | 95% | 1.1.65 |
| wp-time-capsule (WordPress plugin) | CVE-2024-8856 | The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploa | critical 9.8 | 94% | 1.22.22 |
| wp-file-upload (WordPress plugin) | CVE-2024-9047 | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to | critical 9.8 | 93% | 4.24.12 |
| wp-simple-firewall (WordPress plugin) | CVE-2023-0992 | The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up | high 7.2 | 93% | — |
| elementor (WordPress plugin) | CVE-2022-1329 | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of severa | high 8.8 | 93% | — |
| paid-memberships-pro (WordPress plugin) | CVE-2023-23488 | The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL in | critical 9.8 | 92% | 2.9.8 |
| WordPress core | CVE-2019-8943 | WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to | medium 6.5 | 92% | — |
| sexy-contact-form (WordPress plugin) | CVE-2014-8739 | Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plu | critical 9.8 | 92% | 1.0.0 |
| smart-google-code-inserter (WordPress plugin) | CVE-2018-3810 | Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for W | critical 9.8 | 91% | 3.5 |
| post-smtp (WordPress plugin) | CVE-2023-6875 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress pl | critical 9.8 | 90% | — |
| ultimate-member (WordPress plugin) | CVE-2024-1071 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Mem | critical 9.8 | 89% | 2.8.3 |
What to do
- Prioritise by EPSS, not by how often a plugin appears in advisories. Backup and file-manager plugins with upload bugs go first.
- Delete, don't just deactivate. A deactivated plugin's PHP files are still reachable on most installs.
- Scan the install, not the plugin list.
phpwarden wordpress /var/www/htmlreads core, plugin and theme versions off disk and ranks them this way.
Check your own project in one command
Zero dependencies, offline, Apache-2.0. Ranks by KEV → EPSS → CVSS.
pipx install phpwarden
phpwarden deps composer.lock # Composer
phpwarden scan # PHP engine on this host
phpwarden wordpress /var/www/html # WordPress core, plugins, themesIn CI: uses: primeagent001-bot/phpwarden-action@v1
with fail-on: exploited. Or composer require --dev phpwarden/phpwarden.