Skip to main content
cve.nowby Sazabi
Menu
Tech

WordPress CVE feed and alerts

Every new CVE and security advisory affecting WordPress, merged from the CVE List, GitHub, OSV, NVD and CISA KEV into one entry each, with severity, exploitation status and fixed versions. New entries appear within minutes of their source. The feeds are free and need no API key; the newest 200 are listed below.

Critical
22
High
81
On CISA KEV
4

Of the newest 200

Get alerts for new WordPress CVEs

Only want the packages you use? Check a lockfile to get a feed for your stack.

https://cve.now/feed?tech=wordpress
Open feed

Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/feed?tech=wordpress in Slack. For email alerts, give it to an RSS-to-email service.

https://cve.now/feed?tech=wordpress&format=atom
Open feed

The same entries as Atom, for readers that prefer it.

https://cve.now/feed?tech=wordpress&format=json
Open feed

The same entries as JSON Feed 1.1, for scripts and readers that support it.

Frequently asked questions

What are the latest WordPress CVEs?

The newest are CVE-2026-123460 (Nickboss WordPress File Upload stored XSS in file upload handling); CVE-2026-66570 (Nickboss WordPress File Upload cross-site scripting in file upload forms); CVE-2026-119977 (WordPress remote code execution via race in core upgrade installer).

Are any WordPress CVEs being exploited?

4 of the 200 newest WordPress vulnerabilities are on CISA's Known Exploited Vulnerabilities list: CVE-2026-119977, CVE-2026-87902, CVE-2026-63030, CVE-2026-60137.

How many critical WordPress CVEs are there?

22 of the 200 newest are rated critical (CVSS 9.0 or higher, or rated critical by their source when they have no score): CVE-2026-62071, CVE-2026-66447, CVE-2026-63030, CVE-2025-69129, CVE-2026-47365 and more.

How do I get alerts for new WordPress CVEs?

Subscribe to this page's RSS, Atom or JSON feed, or connect a coding agent to the cve.now MCP server. Each new entry appears within minutes of its source.

Is there an RSS feed of WordPress CVEs?

Yes: https://cve.now/feed?tech=wordpress. Add format=atom or format=json for Atom or JSON Feed. It is free and needs no account or API key.

How do I get WordPress CVEs in Slack or by email?

In Slack, run /feed subscribe https://cve.now/feed?tech=wordpress. For email, give the RSS URL to any RSS-to-email service.

WordPress CVE feed and alerts (RSS, JSON) | cve.now