Most Exploited Internet-Facing Products

MEIFP

Back to Ranking

WordPress

Products: WordPress

66.6

Score

3

CVEs

2

Active

1

PoC

2

KEV

#45

Rank

Period:

Product:

CVE ID	Published	CVSS	Exploit	KEV	AC	PR	Auto	Score(hover)	Affected Products	Description
CVE-2026-60137	2026-07-17	5.9v3.1	ACTIVE		High	None	no	26.0	WordPress	WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
CVE-2026-63030	2026-07-17	9.8v3.1	ACTIVE		Low	None	YES	40.6	WordPress	WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
CVE-2025-54352	2025-07-21	3.7v3.1	POC	—	High	None	no	0.0	WordPress	WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not changing this behavior.

Each CVE: 10 pts base (Active only), boosted by:

KEV×2.0AC: Low×1.2PR: None×1.3PR: Low×1.1Auto×1.3