Read the docs

wordpressdotorg

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

wordpressdotorg records in CISA KEV

No wordpressdotorg vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2024-12909 CVE-2024-13889 · GHSA-c27w-wj98-h63p

WordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object Injection

Priority LOW 35

The WordPress Importer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.8.3 via deserialization of untrusted input in the 'maybe_unserialize' function.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00777 Published 2025-03-26 No fix listed CWE-502
TI-2026-83238 CVE-2026-109592 · GHSA-hrw5-8ff3-3cgr

Missing authorization in OpenStation lets users change placements

Priority LOW 20

The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.16.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00345 Published 2026-10-30 No fix listed CWE-862
Open these records in search →