CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CSIRTSSecurity advisory fusion

← All products

WordPress — security advisories

9 advisories4 exploited8 sourceslatest 2026-07-24⚡ RSS feed

Every advisory CSIRTS.com has correlated to WordPress, newest first — across national CERTs, vendor PSIRTs and vulnerability databases.

⚡ Watch WordPress

Get an email when a new WordPress advisory drops — max one per day, one-click unsubscribe.

[NEW] [critical] WordPress: Multiple vulnerabilities allow code execution

criticalCVE-2026-60137 CVE-2026-63030cert-bund2026-07-24

DSA-6399-1 wordpress - security update

unknownCVE-2026-60137debian2026-07-23

WordPress security advisory (AV26-723) - Update 1

unknownexploitedCVE-2026-60137 CVE-2026-63030cccs2026-07-21

WordPress Multiple Vulnerabilities

unknownCVE-2026-63030 CVE-2026-60137hkcert2026-07-20

Multiple vulnerabilities in WordPress (July 20, 2026)

unknownexploitedCVE-2026-60137 CVE-2026-63030cert-fr-alerte2026-07-20

Multiple vulnerabilities in WordPress (July 20, 2026)

unknownCVE-2026-60137 CVE-2026-63030cert-fr-avis2026-07-20

NCSC-2026-0250 [1.00] [H/M] Vulnerabilities fixed in WordPress by Automattic

unknownCVE-2026-60137 CVE-2026-63030ncsc-nl2026-07-18

CVE-2026-63030: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (C

criticalexploitedCVSS 9.8CVE-2026-63030nvd2026-07-17

CVE-2026-60137: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a

mediumexploitedCVSS 5.9CVE-2026-60137nvd2026-07-17

WordPress security advisories · CSIRTS