WordPress Security Incidents
2021 to 2026
Five years of documented core and plugin vulnerabilities. Official advisories, verified CVEs, and what each one meant for site owners.
Patchstack counted 11,334 new WordPress vulnerabilities (core, plugins, and themes combined) in 2025, a 42% increase over 2024. This page tracks the ones that mattered most: the actively exploited zero-days, the supply chain compromises, and the critical flaws in plugins running on millions of sites.
The aggregate data
How to read this page
The curated incidents section below covers 25 of the most significant WordPress security events from 2021 through August 2026. Each entry includes what happened, what it meant for site owners, how it was fixed, and a link to the official advisory or the most authoritative public analysis.
The full database section expands coverage to 49 documented vulnerabilities. You can filter by year, type (core, plugin, theme, supply chain), and severity. For the truly complete list (tens of thousands of entries per year), see the Wordfence Intelligence and Patchstack vulnerability databases.
The 25 that mattered most
2026
wp2shell: WordPress Core pre-auth RCE
All WordPress 6.9.0 through 7.0.1 sites at risk
What happened
Two chained flaws in the WordPress REST API batch processor allowed unauthenticated attackers to execute arbitrary code on any unpatched site. CVE-2026-63030 exploited a validation/execution desync in the /wp-json/batch/v1 endpoint; CVE-2026-60137 was a SQL injection in the posts endpoint's author__not_in parameter. Together they gave full remote code execution with no credentials required.
What it meant for site owners
Any WordPress site running versions 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1 was vulnerable to complete takeover. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on July 21, confirming active exploitation before the full technical disclosure on July 22.
How it was fixed
WordPress released emergency patches on July 17: version 6.9.5 and 7.0.2. Sites with automatic core updates received the fix within hours.
BdThemes supply chain: poisoned promotional API
Users of 7 BdThemes plugins (Element Pack, Prime Slider, Pixel Gallery, and others) sites at risk
What happened
Attackers gained write access to BdThemes' cloud storage and replaced the promotional banner responses that the vendor's plugins fetched on every dashboard load. A cross-site scripting flaw in the banner display component (present since March 2026) let the payload execute silently whenever an admin opened the WordPress dashboard. The plugin code on WordPress.org was clean the entire time.
What it meant for site owners
The malware created hidden administrator accounts, installed webshell backdoors as must-use plugins (which WordPress loads automatically and cannot be deactivated from the dashboard), and used stealth modules to hide the rogue accounts from the user list. Site owners could check their Users page, see nothing wrong, and still be compromised.
How it was fixed
Wordfence published indicators of compromise on August 7. The poisoned endpoints were cleaned August 8, and the plugins were temporarily removed from the WordPress directory. Site owners were advised to check for bd_ admin accounts and unrecognized files in mu-plugins/.
Awesome Motive CDN compromise
1.2 million+ (OptinMonster, TrustPulse, PushEngage users) sites at risk
What happened
Tampered JavaScript files served from Awesome Motive's CDN injected code that created attacker-controlled admin accounts and installed hidden webshell plugins on sites running OptinMonster, TrustPulse, and PushEngage. The window was short (roughly 25 minutes for two of the three plugins), but the delivery mechanism was the vendor's own content delivery network.
What it meant for site owners
Sites that loaded the tampered scripts during the compromise window had rogue admin accounts and backdoor plugins installed silently. Because the scripts ran in the admin context, no user interaction was required beyond being logged into WordPress.
How it was fixed
Awesome Motive identified and cleaned the tampered files. Affected users were advised to audit their admin accounts and plugin directories for unauthorized additions.
ShapedPlugin Pro update flow backdoor
ShapedPlugin Pro plugin customers sites at risk
What happened
Attackers compromised ShapedPlugin's update distribution for its premium plugins. Customers who updated through the official channel received versions containing a backdoor that created hidden admin accounts. Unlike plugin directory compromises, this hit paying customers exclusively, since free users on WordPress.org received clean versions.
What it meant for site owners
Sites that applied the backdoored update had hidden administrator accounts created. The backdoor went undetected for approximately four months before discovery.
How it was fixed
ShapedPlugin cleaned the update channel and released verified versions. Affected users needed to audit their admin accounts and check for unauthorized changes.
ARVE plugin backdoor
~20,000 sites at risk
What happened
The Advanced Responsive Video Embedder (ARVE) plugin version 10.8.7 shipped with a backdoor that sent site and administrator details to an attacker-controlled server and enabled unauthenticated admin access. The backdoor was embedded in what appeared to be a legitimate plugin update.
What it meant for site owners
Affected sites had their admin credentials and site information exfiltrated. The backdoor also allowed the attacker to log in as an administrator without credentials.
How it was fixed
Wordfence identified the backdoor and published indicators of compromise. The compromised version was removed from WordPress.org and a clean release was issued.
2025
SureTriggers authorization bypass
100,000+ sites at risk
What happened
A missing empty-value check in the SureTriggers plugin's REST API authentication allowed unauthenticated attackers to create administrator accounts on any site where the plugin was installed but had not completed its initial API key setup. Exploits appeared in the wild within four hours of public disclosure.
What it meant for site owners
Attackers created rogue admin accounts on vulnerable sites, gaining full control. The four-hour exploitation window meant that even sites with prompt update habits were at risk if they saw the disclosure but could not patch immediately.
How it was fixed
SureTriggers released version 1.0.79 with the fix. Site owners were advised to check for unauthorized admin accounts.
OttoKit (SureTriggers) privilege escalation
100,000+ sites at risk
What happened
A second vulnerability in the same plugin (now rebranded to OttoKit) allowed unauthenticated privilege escalation through the automation workflow endpoints. Attackers could create or promote accounts to administrator level without valid credentials.
What it meant for site owners
Combined with the April bypass, OttoKit/SureTriggers sites faced two critical unauthenticated escalation paths within a month. Exploit code circulated on GitHub.
How it was fixed
Version 1.0.83 patched the privilege escalation. The rapid succession of two critical flaws prompted Wordfence to flag the plugin for extra monitoring.
2024
LiteSpeed Cache privilege escalation
5,000,000+ sites at risk
What happened
A flaw in LiteSpeed Cache's user simulation feature let unauthenticated attackers brute-force a weak security hash and gain administrator access to the site. The hash was only six characters, making brute-force practical.
What it meant for site owners
With admin access, attackers could install backdoor plugins, modify content, steal data, or redirect visitors. Over five million sites used the plugin at the time of disclosure.
How it was fixed
LiteSpeed released version 6.4 with a strengthened hash. Wordfence and Patchstack both published advisories urging immediate updates.
GiveWP PHP object injection to RCE
100,000+ sites at risk
What happened
The GiveWP donation plugin had an unauthenticated PHP object injection vulnerability in its donation form value parameter. An attacker could chain it with a POP gadget to achieve full remote code execution, no login required. CVSS 10.0.
What it meant for site owners
Any site running GiveWP for donations was vulnerable to complete takeover through the public donation form. Sensitive donor data (names, emails, payment info) was at risk alongside the site itself.
How it was fixed
GiveWP released version 3.14.2 with the fix. Wordfence awarded a $4,998 bug bounty for the discovery.
Really Simple Security authentication bypass
4,000,000+ sites at risk
What happened
The Really Simple Security plugin (Free, Pro, and Pro Multisite editions) had an authentication bypass that allowed unauthenticated attackers to log in as any user, including administrators. CVSS 9.8. The irony of a security plugin containing a critical authentication flaw was not lost on the WordPress community.
What it meant for site owners
Four million sites trusted this plugin for their security. An attacker exploiting this flaw could log in as any user, including the site administrator, and take full control.
How it was fixed
The plugin was patched, and WordPress.org coordinated a forced auto-update due to the severity and the size of the install base.
Forminator unrestricted file upload
300,000+ sites at risk
What happened
Forminator's file upload handling had an unrestricted file upload vulnerability (CVSS 9.8) that allowed unauthenticated attackers to upload and execute arbitrary files, including PHP backdoors, through the plugin's form submission handler.
What it meant for site owners
Any site using Forminator with file upload fields was vulnerable to remote code execution through the public-facing form.
How it was fixed
JEPCERT and the plugin developer coordinated disclosure. An updated version restricted the allowed file types and added proper validation.
Hunk Companion arbitrary plugin installation
10,000+ sites at risk
What happened
Hunk Companion had an unauthenticated REST API endpoint that let attackers install and activate arbitrary plugins from the WordPress.org repository without authentication. Attackers used this to install known-vulnerable plugins and then exploit those plugins to backdoor the site, a chained attack that bypassed any security measures on the site itself.
What it meant for site owners
This was a meta-vulnerability: it turned the entire WordPress plugin directory into an attack surface. Attackers installed outdated plugins with known flaws, then exploited those flaws for RCE, SQL injection, or XSS.
How it was fixed
Version 1.9.0 removed the vulnerable endpoint. Sites were advised to audit installed plugins for any they did not intentionally add.
Jetpack patches an 8-year-old vulnerability
27,000,000 sites at risk
What happened
Automattic patched a vulnerability in Jetpack's Contact Form feature that had been present since 2016. The flaw allowed any logged-in user to read form submissions from other visitors, including sensitive data. Jetpack coordinated a mass auto-update across 101 patched versions.
What it meant for site owners
Twenty-seven million sites had this flaw for eight years. Any site using Jetpack's built-in contact form had its submissions readable by any authenticated user, not just administrators.
How it was fixed
Jetpack pushed auto-updates across all 101 affected versions simultaneously. No public exploitation was confirmed, but the eight-year exposure window made it impossible to rule out.
2023
WooCommerce Payments admin takeover
600,000+ sites at risk
What happened
WooCommerce Payments versions 4.8.0 through 5.6.1 had an authentication bypass (CVSS 9.8) that allowed unauthenticated attackers to impersonate any user, including site administrators. Adding a single HTTP header to a request was enough to gain full admin access.
What it meant for site owners
Attackers gained complete control of WooCommerce stores, including access to customer payment data, order history, and the ability to modify the store or redirect payments. Mass exploitation began in July 2023, four months after the patch.
How it was fixed
Automattic coordinated a forced auto-update through WordPress.org, pushing patched versions to all affected installations. WordPress.com and managed hosting platforms received immediate mitigation.
Essential Addons for Elementor privilege escalation
1,000,000+ sites at risk
What happened
Essential Addons for Elementor versions 5.4.0 through 5.7.1 had an unauthenticated privilege escalation (CVSS 9.8) in its password reset function. An attacker could reset any user's password without knowing the current one, then log in as that user.
What it meant for site owners
Over a million sites were vulnerable to complete takeover. Patchstack and Wordfence confirmed active exploitation within days of disclosure, with attackers resetting administrator passwords and taking control of sites.
How it was fixed
Version 5.7.2 fixed the password reset logic. Patchstack, who discovered the flaw, coordinated with the vendor for responsible disclosure.
Ultimate Member zero-day privilege escalation
200,000+ sites at risk
What happened
A privilege escalation in Ultimate Member was exploited as a zero-day before the vendor was aware of it. Attackers registered new accounts through the plugin's public registration form and elevated themselves to administrator by manipulating user meta values, bypassing the plugin's role restrictions.
What it meant for site owners
Sites with public registration enabled through Ultimate Member were actively compromised. The first two patch attempts by the vendor failed to fully close the vulnerability, extending the exposure window.
How it was fixed
Version 2.6.7 finally fixed the flaw after two incomplete patches. Sites were advised to temporarily disable user registration until the fix was confirmed working.
Elementor Pro broken access control
5,000,000+ (Elementor installs) sites at risk
What happened
Elementor Pro had a broken access control vulnerability that, when WooCommerce was also installed, allowed authenticated users with subscriber-level access to update arbitrary site options. This could be used to enable user registration and set the default role to administrator.
What it meant for site owners
On sites running both Elementor Pro and WooCommerce (a common combination for e-commerce), any authenticated user could escalate to admin. Active exploitation was confirmed in the wild.
How it was fixed
Elementor released version 3.11.7 with the fix. NinTechNet published the first public analysis.
Popup Builder stored XSS / Balada Injector campaign
200,000+ installs; 7,100+ confirmed infections sites at risk
What happened
A stored cross-site scripting vulnerability in Popup Builder let unauthenticated attackers inject malicious JavaScript into popup event handlers. The Balada Injector campaign used this at scale starting in January 2024, redirecting visitors to scam sites and installing backdoors.
What it meant for site owners
Infected sites redirected visitors to phishing and scam pages. The malware was persistent and survived basic cleanup attempts, requiring database-level removal of the injected scripts from popup configurations.
How it was fixed
Popup Builder patched the XSS in version 4.2.3. Sucuri published detailed cleanup instructions for sites already infected by the Balada Injector.
2022
WordPress Core 5.8.3: SQL injection and XSS
All WordPress before 5.8.3 sites at risk
What happened
WordPress 5.8.3 fixed four vulnerabilities, including a SQL injection in WP_Query (CVE-2022-21661) that could be exploited through plugins and themes using the class, a stored cross-site scripting flaw in post slugs, and an object injection issue. The SQL injection was the most severe, enabling database extraction through any code path that passed unsanitized tax_query input to WP_Query.
What it meant for site owners
While WordPress Core is not directly exploitable through the default front-end, any theme or plugin that passed user input to WP_Query's tax_query without sanitization opened the door. Several popular themes were confirmed vulnerable.
How it was fixed
WordPress pushed auto-updates to all supported branches. The security release was coordinated across 5.8.3, 5.7.5, 5.6.7, 5.5.8, 5.4.9, 5.3.11, 5.2.14, 5.1.12, 5.0.15, 4.9.19, 4.8.18, 4.7.22, 4.6.22, 4.5.25, 4.4.26, 4.3.27, 4.2.31, 4.1.34, and 3.7.38.
Elementor remote code execution
5,000,000+ sites at risk
What happened
Elementor versions 3.6.0 through 3.6.2 had a remote code execution vulnerability that allowed any authenticated user (including subscribers) to upload and execute arbitrary PHP files by bypassing the plugin's upload restrictions. The flaw was in the onboarding module.
What it meant for site owners
Any logged-in user on the five million sites running affected Elementor versions could execute arbitrary code on the server.
How it was fixed
Elementor released version 3.6.3 with the fix. Wordfence published a detailed technical analysis.
AccessPress supply chain attack: 93 add-ons backdoored
360,000+ (combined installs of affected add-ons) sites at risk
What happened
Attackers compromised the AccessPress (now ThemeGrill) website and injected backdoors into the downloadable versions of 40 themes and 53 plugins. The backdoored versions were available for download from the vendor's site for months before detection. The WordPress.org repository copies were clean; only users who downloaded directly from AccessPress were affected.
What it meant for site owners
Sites running the backdoored versions had a webshell installed in the wp-includes/vars.php file, giving attackers full access. Because the backdoor was in a core WordPress file, updates to the plugin or theme alone did not remove it.
How it was fixed
Sucuri and Jetpack published detailed indicators. Affected sites needed to replace the modified vars.php file from a clean WordPress installation, not just update the plugins.
BackupBuddy zero-day arbitrary file download
140,000+ sites at risk
What happened
BackupBuddy (now Jetomatic Backup) had a zero-day vulnerability that allowed unauthenticated attackers to download arbitrary files from the server, including wp-config.php (which contains database credentials and authentication keys). Wordfence blocked nearly five million exploitation attempts targeting this flaw.
What it meant for site owners
Attackers exfiltrated wp-config.php files at scale, gaining database credentials and authentication salts. This gave them the ability to log into databases directly, forge authentication cookies, and access any data stored in WordPress.
How it was fixed
iThemes (now SolidWP) patched version 8.7.5 on September 2, 2022, the same day they confirmed the zero-day. Sites were advised to rotate database passwords and WordPress salts immediately.
WPGateway zero-day admin creation
WPGateway installs (count not disclosed) sites at risk
What happened
WPGateway, a premium plugin for managing WordPress sites, had a zero-day privilege escalation that allowed unauthenticated attackers to create administrator accounts. The vulnerability was actively exploited before any patch was available, with Wordfence blocking over 4.6 million attacks in 30 days.
What it meant for site owners
Attackers created rogue administrator accounts named "rangex" on affected sites. Because this was a zero-day with no available patch, the only mitigation was removing the plugin entirely.
How it was fixed
Wordfence published detection guidance while the vendor worked on a patch. Site owners were advised to deactivate and remove the plugin until a fix was available.
UpdraftPlus backup exposure (force-patched)
3,000,000+ sites at risk
What happened
UpdraftPlus had a vulnerability that allowed any logged-in user (including subscribers) to download the site's backup files, which typically contain the entire database, all uploaded media, and configuration files. The severity was high enough that WordPress.org took the unusual step of force-pushing the update to all three million installations.
What it meant for site owners
Anyone with a subscriber account could download full site backups, including database contents with user credentials, customer data, and WordPress authentication keys.
How it was fixed
WordPress.org force-updated all installations to UpdraftPlus Free 1.22.3 and Premium 2.22.3. This was one of the few times WordPress has used its force-update capability for a plugin.
2021
All in One SEO: privilege escalation and SQL injection
3,000,000+ sites at risk
What happened
All in One SEO Pack had two critical vulnerabilities: a privilege escalation (CVE-2021-25036, CVSS 9.9) that allowed low-privilege users to elevate to admin, and a SQL injection (CVE-2021-25037, CVSS 7.7) in the REST API. Used together, a subscriber-level user could take complete control of the site and extract the entire database.
What it meant for site owners
Three million sites were exposed. The privilege escalation required only a subscriber account, which many WordPress sites grant to commenters or members automatically. Two weeks after the patch, 800,000 sites still had not updated.
How it was fixed
AIOSEO released version 4.1.5.3 on December 7, 2021. Sucuri and Jetpack published coordinated advisories urging immediate updates.
49 documented vulnerabilities
Filter by year, type, or severity. Click any CVE to open the advisory. This table covers the critical and high-severity incidents we verified across official sources.
Showing 49 entries
| Date | Component | Type | CVE | CVSS | Sites at risk | Summary | Advisory |
|---|---|---|---|---|---|---|---|
| 2026 Jul | WordPress Core (wp2shell) | Core | CVE-2026-63030 | 9.8 Critical | All WP 6.9 to 7.0 | Unauthenticated RCE via REST API batch processor; chained with SQLi CVE-2026-60137 | View → |
| 2026 Aug | BdThemes (7 plugins) | Supply Chain | N/A | Critical | Unknown | Poisoned promotional API created hidden admins and installed webshell backdoors | View → |
| 2026 Jun | OptinMonster / TrustPulse / PushEngage | Supply Chain | N/A | Critical | 1.2M+ | Awesome Motive CDN scripts tampered; admin accounts and webshells injected | View → |
| 2026 Jun | ShapedPlugin Pro plugins | Supply Chain | N/A | Critical | Pro customers | Premium update channel compromised; backdoored updates created hidden admin accounts | View → |
| 2026 Jul | ARVE (Advanced Responsive Video Embedder) | Supply Chain | CVE-2026-18072 | 9.8 Critical | ~20,000 | Backdoor in v10.8.7 exfiltrated admin credentials and enabled unauthenticated login | View → |
| 2026 Mar | Ally Plugin | Plugin | CVE-2026-2413 | 9.8 Critical | 400,000 | Unauthenticated SQL injection enabling full database extraction | View → |
| 2026 Apr | WP Maps Pro | Plugin | CVE-2026-3222 | 8.8 High | Unknown | Subscriber-level SQL injection via backtick character injection | View → |
| 2025 Dec | LiteSpeed Cache | Plugin | CVE-2025-12450 | 8.3 High | 7,000,000 | Unauthenticated stored XSS in cached pages; cookie theft and redirect injection | View → |
| 2025 Apr | SureTriggers | Plugin | CVE-2025-3102 | 9.8 Critical | 100,000+ | Auth bypass via missing empty-value check; unauthenticated admin creation | View → |
| 2025 May | OttoKit (SureTriggers) | Plugin | CVE-2025-27007 | 9.8 Critical | 100,000+ | Unauthenticated privilege escalation via automation workflow endpoints | View → |
| 2025 Mar | FunnelKit Automations | Plugin | N/A | 9.8 Critical | Unknown | Unauthenticated arbitrary plugin installation | View → |
| 2025 Jun | Ads Pro | Plugin | N/A | 9.8 Critical | Unknown | Local file inclusion allowing server file read | View → |
| 2025 Feb | Quiz and Survey Master | Plugin | N/A | 9.8 Critical | 40,000 | Unauthenticated SQLi via quiz result endpoint; weaponized within 24 hours of disclosure | View → |
| 2025 Jul | LA-Studio Element Kit | Supply Chain | N/A | 9.8 Critical | Unknown | Insider-planted backdoor creating admin accounts via hidden URL parameter; undetected for 4 months | View → |
| 2024 Aug | LiteSpeed Cache | Plugin | CVE-2024-28000 | 9.8 Critical | 5,000,000+ | Unauthenticated privilege escalation via weak 6-character security hash brute-force | View → |
| 2024 Aug | LiteSpeed Cache | Plugin | CVE-2024-44000 | 7.5 High | 5,000,000+ | Unauthenticated account takeover via exposed debug log containing session cookies | View → |
| 2024 Aug | GiveWP | Plugin | CVE-2024-5932 | 10.0 Critical | 100,000+ | Unauthenticated PHP object injection to RCE via donation form parameter | View → |
| 2024 Nov | Really Simple Security | Plugin | CVE-2024-10924 | 9.8 Critical | 4,000,000+ | Authentication bypass allowing login as any user including admin | View → |
| 2024 Apr | Forminator | Plugin | CVE-2024-28890 | 9.8 Critical | 300,000+ | Unrestricted file upload enabling unauthenticated RCE via form submissions | View → |
| 2024 Dec | Hunk Companion | Plugin | CVE-2024-11972 | 9.8 Critical | 10,000+ | Unauthenticated REST endpoint for arbitrary plugin install; used to chain known-vulnerable plugins | View → |
| 2024 Oct | Jetpack | Plugin | Withheld | 7.5 High | 27,000,000 | 8-year-old flaw in Contact Form let any logged-in user read other visitors' submissions | View → |
| 2024 Jan | Popup Builder (Balada Injector) | Plugin | CVE-2023-6000 | 8.3 High | 200,000+ | Stored XSS exploited at scale by Balada Injector; 7,100+ sites confirmed infected | View → |
| 2024 Apr | WP Automatic | Plugin | CVE-2024-27956 | 9.9 Critical | 40,000+ | SQL injection in post import functionality; unauthenticated database manipulation | View → |
| 2024 Mar | LayerSlider | Plugin | CVE-2024-2879 | 9.8 Critical | 1,000,000+ | Unauthenticated SQL injection via slider popup markup parameters | View → |
| 2024 Jan | Better Search Replace | Plugin | CVE-2023-6933 | 9.8 Critical | 1,000,000+ | PHP object injection via deserialization of untrusted data | View → |
| 2024 Apr | WP Statistics | Plugin | CVE-2024-2194 | 7.2 High | 600,000+ | Stored XSS allowing unauthenticated JavaScript injection into analytics pages | View → |
| 2023 Mar | WooCommerce Payments | Plugin | CVE-2023-28121 | 9.8 Critical | 600,000+ | Unauthenticated admin impersonation via single HTTP header; mass exploitation Jul 2023 | View → |
| 2023 May | Essential Addons for Elementor | Plugin | CVE-2023-32243 | 9.8 Critical | 1,000,000+ | Unauthenticated privilege escalation via password reset function | View → |
| 2023 Jul | Ultimate Member | Plugin | CVE-2023-3460 | 9.8 Critical | 200,000+ | Zero-day privilege escalation via registration form meta manipulation; two failed patches before fix | View → |
| 2023 Apr | Elementor Pro | Plugin | CVE-2023-1998 | 8.8 Critical | 5,000,000+ | Broken access control; subscriber can update site options when WooCommerce is active | View → |
| 2023 Nov | Popup Builder | Plugin | CVE-2023-6000 | 8.3 High | 200,000+ | Unauthenticated stored XSS via popup event handlers; later exploited by Balada Injector | View → |
| 2023 Jun | Jetpack | Plugin | CVE-2023-2996 | 8.1 Critical | 5,000,000+ | Arbitrary file manipulation for authenticated users (contributor+) | View → |
| 2023 Oct | Royal Elementor Addons | Plugin | CVE-2023-5360 | 9.8 Critical | 200,000+ | Unauthenticated arbitrary file upload bypassing extension checks | View → |
| 2023 Jun | WordPress Core 6.2.2 | Core | Multiple | 5.4 Medium | All WP < 6.2.2 | Five security patches including shortcode execution in user-generated content and directory traversal | View → |
| 2022 Jan | WordPress Core 5.8.3 | Core | CVE-2022-21661 | 8.0 High | All WP < 5.8.3 | SQL injection in WP_Query tax_query; stored XSS in post slugs; object injection | View → |
| 2022 Oct | WordPress Core 6.0.3 | Core | Multiple | High | All WP < 6.0.3 | 16 security fixes including stored XSS, open redirect, SQL injection via bookmarks, and data exposure | View → |
| 2022 Apr | Elementor | Plugin | CVE-2022-1329 | 8.8 Critical | 5,000,000+ | Authenticated RCE; any subscriber-level user could upload and execute PHP via onboarding module | View → |
| 2022 Jan | AccessPress (93 add-ons) | Supply Chain | N/A | Critical | 360,000+ | Vendor site compromised; 40 themes and 53 plugins backdoored for months; webshell in wp-includes/vars.php | View → |
| 2022 Sep | BackupBuddy | Plugin | CVE-2022-31474 | 7.5 High | 140,000+ | Zero-day arbitrary file download; ~5M exploitation attempts; wp-config.php exfiltration at scale | View → |
| 2022 Sep | WPGateway | Plugin | CVE-2022-3180 | 9.8 Critical | Unknown | Zero-day unauthenticated admin account creation; 4.6M attacks in 30 days; no patch available initially | View → |
| 2022 Feb | UpdraftPlus | Plugin | CVE-2022-0633 | 8.5 High | 3,000,000+ | Subscriber-level users could download full backups; WordPress.org force-pushed the update | View → |
| 2022 May | Tatsu Builder | Plugin | CVE-2021-25094 | 8.8 Critical | 100,000+ | RCE via unauthenticated file upload; millions of attacks observed in May 2022 exploitation wave | View → |
| 2022 Feb | PHP Everywhere | Plugin | CVE-2022-24663 | 9.9 Critical | 30,000+ | Three RCE vulnerabilities; subscriber-level users could execute arbitrary PHP on the server | View → |
| 2021 Dec | All in One SEO Pack | Plugin | CVE-2021-25036 | 9.9 Critical | 3,000,000+ | Subscriber-level privilege escalation to admin plus SQL injection in REST API; 800K still unpatched two weeks later | View → |
| 2021 Feb | Ninja Forms | Plugin | Multiple | 8.8 High | 1,000,000+ | Four severe vulnerabilities including stored XSS, email forgery, and access control bypass | View → |
| 2021 Sep | OptinMonster | Plugin | CVE-2021-39341 | 7.2 High | 1,000,000+ | REST API access control bypass allowing unauthenticated campaign data modification and XSS injection | View → |
| 2021 Jul | WooCommerce | Plugin | CVE-2021-32789 | 8.2 Critical | 5,000,000+ | SQL injection via WooCommerce lookup tables; actively exploited; emergency patch and database check | View → |
| 2021 Nov | WP Fastest Cache | Plugin | CVE-2021-24869 | 7.7 High | 1,000,000+ | SQL injection and stored XSS allowing unauthenticated database access | View → |
| 2021 Jun | Starter Templates (Starter Templates Starter Sites) | Plugin | CVE-2021-24suspended | 9.9 Critical | 1,000,000+ | Arbitrary file overwrite allowing unauthenticated stored XSS and potential RCE | View → |
About this data. This table covers critical and high-severity incidents that were publicly disclosed between January 2021 and August 2026. It is not a complete catalog of every WordPress vulnerability (Patchstack alone documents thousands per year). For full coverage, consult the Wordfence Intelligence and Patchstack databases. We update this page as new incidents are confirmed.
Sources and methodology
Every entry on this page was verified against at least two independent sources before inclusion. The primary sources are:
Patchstack annual reports
Aggregate statistics, top-exploited lists, and premium plugin data
Wordfence Intelligence
Individual vulnerability advisories, exploitation data, and attack metrics
WordPress.org security releases
Official core vulnerability patches and release notes
WPScan vulnerability database
CVE tracking and exploit proof-of-concept references
CVE numbers, CVSS scores, and affected version ranges come from the National Vulnerability Database (NVD) where available, cross-referenced against vendor and researcher disclosures. "Sites at risk" counts reflect the plugin\'s install base at the time of disclosure, not confirmed compromises. Supply chain incidents are categorized separately because they cannot be prevented by updating plugins or running a WAF.
The WordPress content cluster
WordPress Supply Chain Attacks: The Risk You Can't Patch
Four vendors compromised in ten weeks. Why keeping plugins updated no longer covers you.
Read the post →Why WordPress Plugin-Hell is Killing Your Lead Generation
What the plugin economy actually costs a site whose job is producing leads.
Read the post →WordPress Triage: Optimize, Harden, or Leave?
Objective thresholds for deciding what your WordPress site actually needs.
Read the post →Want to know what your WordPress site is actually carrying?
Considering the alternatives? See how I build on Astro →