WordPress Historical CVE List

WORDPRESS HISTORICAL SECURITY VULNERABILITIES

1. CVE-2026-62062
Plugin: Elementor
Vulnerability: CSRF / Privilege Escalation
Affected: 4.3.0–4.3.1
Patch Date: 24 September 2026
Fixed Version: 4.3.2

2. CVE-2022-0992
Plugin: SiteGround Security
Vulnerability: Authentication Bypass
Affected: 1.2.5 and earlier
Patch Date: 7 April 2022
Fixed Version: 1.2.6

3. CVE-2025-66121
Plugin: SiteGround Security
Vulnerability: Missing Authorisation
Affected: 1.5.8 and earlier
Patch Date: 15 January 2026
Fixed Version: 1.5.9

4. CVE-2026-32352
Plugin: Elementor
Vulnerability: Stored Cross-Site Scripting (XSS)
Affected: 3.35.5 and earlier
Patch Date: 3 March 2026
Fixed Version: 3.35.6

5. CVE-2025-8081
Plugin: Elementor
Vulnerability: Arbitrary File Reading
Affected: 3.30.2 and earlier
Patch Date: 22 July 2025
Fixed Version: 3.30.3

6. CVE-2026-15425
Plugin: Yoast SEO
Vulnerability: Stored Cross-Site Scripting (XSS)
Affected: 28.0 and earlier
Patch Date: 21 July 2026
Fixed Version: 28.1

7. CVE-2024-4041
Plugin: Yoast SEO
Vulnerability: Reflected Cross-Site Scripting (XSS)
Affected: 22.5 and earlier
Patch Date: 30 April 2024
Fixed Version: 22.6

8. WordPress REST API Vulnerability (2017)
Component: WordPress Core
Vulnerability: Unauthenticated Privilege Escalation
Affected: 4.7.0–4.7.1
Patch Date: 26 January 2017
Fixed Version: 4.7.2

NOTE: These are historical vulnerabilities. Their presence on any particular website has not been confirmed. Patch dates refer to reported fix releases, not mandatory deadlines.