WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher privileged user accesses the affected administrative screens. This issue only affects sites with a large number of users.
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site administrator has configured at least one custom checkout field of type Html or File, which is a standard documented plugin feature.
CVE-2026-87902 is a critical unauthenticated remote code execution vulnerability in WordPress versions 4.7.0 through 7.1.1. It allows attackers to include arbitrary PHP files outside the active theme directories, potentially leading to code execution. The flaw was patched in WordPress 7.1.2 and backported to supported branches down to 4.7. Exploitation attempts began shortly after the patch release, with attackers writing malicious PHP files to disk to execute shell commands. Immediate updating to version 7.1.2 or later is strongly advised.
The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twiz_ajax_callback AJAX action's 'savesection' handler combined with the use of eval() to execute user-supplied 'custom logic' code on the frontend. The AJAX handler at twiz-ajax.php verifies a nonce but performs no current_user_can() capability check for the ACTION_SAVE_SECTION case. Furthermore, the nonce is exposed to any authenticated user through the directly-accessible twiz-ajax.js.php file which loads WordPress and outputs the nonce. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary PHP code via the twiz_custom_logic POST parameter when saving a section with output choice 'twiz_logic_output'.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS.
This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2.
CVE-2026-74013 is a high severity SQL Injection vulnerability affecting WordPress.com eShipper Commerce versions up to 2.16.13. It involves improper neutralization of special elements in SQL commands, specifically in the subscriber functionality. This vulnerability allows an attacker with low privileges and no user interaction to cause a partial impact on availability and a complete impact on confidentiality. No official patch or remediation information is provided in the available data.
WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously crafted argument such as 'system'('id') would execute during a scan; as a result, running PHPCS with WordPressCS over untrusted PHP (for example a CI pipeline that lints pull requests, or a developer reviewing third-party code) could lead to arbitrary command execution on the scanning host. The WordPress-Core and WordPress-Docs rulesets are not affected. This issue is fixed in version 3.4.1.
An unauthenticated attacker can chain two WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, to achieve remote code execution against affected WordPress installations. Multiple security firms have confirmed active in-the-wild exploitation within days of public disclosure, and public proof-of-concept exploits are circulating. Key takeaways: Two WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, can be chained together to achieve pre-authentication remote code execution against WordPress 6.9.x and 7.0.x installations. Multiple security firms have confirmed in-the-wild exploitation, with public proof-of-concept exploits appearing within hours of the July 17, 2026 disclosure. Patches are available in WordPress 7.0.2 and 6.9.5; WordPress.org has enabled forced automatic updates across affected supported installations. Background Tenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding wp2shell, two vulnerabilities in WordPress Core that can be chained together to achieve pre-authentication remote code execution. FAQ What is wp2shell? wp2shell is the name given to two vulnerabilities in WordPress Core. When was wp2shell first disclosed? On July 17, 2026, WordPress released security updates addressing the wp2shell vulnerabilities alongside two GitHub Security Advisories. Adam Kues of Searchlight Cyber, who discovered and disclosed CVE-2026-63030, published research on the same day and chose to hold back the technical specifics given the severity of the finding. Searchlight Cyber also launched wp2shell.com , a testing tool that allows administrators to check whether their WordPress installation is vulnerable. On July 20, Searchlight Cyber published a full technical breakdown of the attack chain. What are the vulnerabilities associated with wp2shell? wp2shell is a two-vulnerability exploit chain affecting WordPress Core. CVE Description CVSSv3 CVE-2026-63030 WordPress Core REST API Batch-Route Confusion Remote Code Execution Vulnerability 9.8 CVE-2026-60137 WordPress Core WP_Query author__not_in SQL Injection Vulnerability 5.9 CVE-2026-63030 is a REST API batch-route confusion weakness introduced in WordPress 6.9. CVE-2026-60137 is a SQL injection flaw in the author__not_in parameter of WP_Query , present in WordPress 6.8 and later. When chained on WordPress 6.9.0 through 7.0.1, the two flaws allow an unauthenticated attacker to reach the REST API batch endpoint at /wp-json/batch/v1 and achieve remote code execution. CVE-2026-60137 was discovered and disclosed by security researchers TF1T, dtro, and haongo. CVE-2026-60137 also affects WordPress 6.8.0 through 6.8.5 as a standalone SQL injection issue. Because CVE-2026-63030 was introduced in WordPress 6.9, the full RCE chain is only achievable on 6.9.x and 7.0.x installations. How severe is the wp2shell vulnerability chain? An anonymous, unauthenticated user can execute the chain against a default WordPress installation with no plugins required. No preconditions exist beyond the default WordPress configuration. Cloudflare notes that the vulnerable code path is reached when “a persistent object cache is not in use.” Note: wp2shell targets WordPress Core itself rather than a plugin or theme. All four prior WordPress-related entries in the CISA Known Exploited Vulnerabilities (KEV) catalog involve plugins, not core. Pre-authentication remote code execution in WordPress Core is uncommon. CVE Product Added to KEV Ransomware CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared) April 30, 2026 Known CVE-2020-25213 WordPress File Manager Plugin November 3, 2021 Unknown CVE-2020-11738 WordPress Snap Creek Duplicator Plugin November 3, 2021 Unknown CVE-2019-9978 WordPress Social Warfare Plugin November 3, 2021 Unknown How widespread are the attacks exploiting wp2shell? WordPress is the most widely deployed content management system in the world. Some hosted installations will receive patc…
WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 contain a vulnerability where the author__not_in parameter in WP_Query is not properly sanitized. This flaw can lead to SQL Injection if untrusted input is passed to this parameter by plugins or themes. The vulnerability has a high severity with a CVSS score of 9.1. Several older Ubuntu package versions of WordPress are also affected.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Path Traversal.This issue affects Forminator: from n/a through <= 1.55.0.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows DOM-Based XSS.This issue affects Forminator: from n/a through <= 1.55.0.1.
The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 10.30.32. This is due to missing or incorrect nonce validation on the setCustomText function. This makes it possible for unauthenticated attackers to inject arbitrary PHP code into the web-accessible translate-constants.php file within the plugin directory, enabling remote code execution on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. sanitize_text_field() is applied to the POST 'value' parameter but does not neutralize the characters — single quotes, parentheses, semicolons, $, and [] — required to break out of the PHP string literal into which the value is interpolated before being written to disk via file_put_contents().
CVE-2026-39591 is a critical vulnerability in the WP-BusinessDirectory plugin for WordPress by CMSJunkie, affecting versions up to and including 4.0.0. It allows subscribers to upload arbitrary files without proper restrictions, leading to potential full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type). No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-39492 is a critical unauthenticated SQL Injection vulnerability in the WP Maps plugin by Flipper Code – WordPress Development Company, affecting versions up to and including 4.9.1. This vulnerability allows an attacker to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor advisories for updates and consider mitigating exposure until a fix is released.