Recently exploited vulnerabilities

Get more with our API

Affected software \| Vulnerability	Priority	Disclosed
Request a Quote for WooCommerce<= 2.9.2 Unauthenticated Arbitrary File Upload vulnerability	10	5 days ago
Bookly<= 28.2 Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion vulnerability	6.5	25/09/2026
Contact Form by WPForms<= 2.0.2 Reflected Cross-Site Scripting vulnerability	7.1	25/09/2026
Elementor Website Builder4.3.0-4.3.1 Cross Site Request Forgery (CSRF) vulnerability	8.8	25/09/2026
Visual Composer Website Builder<= 45.16.0 Unauthenticated Local File Inclusion vulnerability	9.8	24/09/2026

WordPress vulnerability statistics

General WordPress security vulnerability statistics powered by the Patchstack Vulnerability Database.

Vulnerabilities disclosed via Patchstack

464By Patchstack Alliance

1,089By other sources

Most common security vulnerabilities

How to patch common vulnerabilities

#1Other vulnerabilities
32.97%
#2Cross-Site Scripting (XSS)
32.52%
#3Broken Access Control
17.45%
#4SQL Injection
7.08%
#5Sensitive Data Exposure
6.05%
#6Arbitrary File Upload
2.06%
#7Cross-Site Request Forgery (CSRF)
1.87%
Disclosed by
Patchstack
Other sources

Patch status of published vulnerabilities

Not patched

#15010%

Patched

#1,40390%

Breakdown by software type

Plugin

#1,51898%

Theme

#231%

Core

#121%

Breakdown by patch priority

High (Resolve immediately)

#27117%

Medium (Resolve in 14 days)

#42727%

Low (Resolve in 30 days)

#85555%

Breakdown by CVSS severity

Critical (9.0-10.0)

#1389%

High (7.0-8.9)

#54335%

Medium (4.0-6.9)

#81452%

Low (0.1-3.9)

#574%

Top security researchers by contributions

See leaderboard

# Researcher

Reports

Country

Plugins with a VDP earn +15%
XP and
Zeroday payouts up to $33,000!
Plugins with a VDP earn +15% XP and Zeroday payouts up to $33,000!