Recently exploited vulnerabilities

Get more with our API
Affected software | Vulnerability
Priority
Disclosed
Burst Statistics3.4.0-3.4.1.1
Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin 3.4.0-3.4.1.1 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover vulnerability
9.8
4 days ago
User Registration Advanced Fields<= 1.6.20
Unauthenticated Arbitrary File Upload vulnerability
10
05/05/2026
JoomSport<= 5.7.7
SQL Injection vulnerability
9.3
29/04/2026
Drag and Drop Multiple File Upload – Contact Form 7<= 1.3.9.6
Unauthenticated Arbitrary File Upload via Non-ASCII Filename Blacklist Bypass vulnerability
8.1
20/04/2026
WP Statistics<= 14.16.4
Unauthenticated Stored Cross-Site Scripting via 'utm_source' Parameter vulnerability
7.1
17/04/2026

WordPress vulnerability statistics

General WordPress security vulnerability statistics powered by the Patchstack Vulnerability Database.

Vulnerabilities disclosed via Patchstack

18,657By Patchstack Alliance
20,231By other sources

Most common security vulnerabilities

How to patch common vulnerabilities
  • #1Cross-Site Scripting (XSS)
    41.77%
  • #2Other vulnerabilities
    17.64%
  • #3Cross-Site Request Forgery (CSRF)
    13.70%
  • #4Broken Access Control
    12.80%
  • #5SQL Injection
    6.20%
  • #6Sensitive Data Exposure
    5.23%
  • #7Arbitrary File Upload
    2.67%
  • Disclosed by
    Patchstack
    Other sources

Patch status of published vulnerabilities

Not patched
#11,13529%
Patched
#27,75371%

Breakdown by software type

Plugin
#35,58892%
Theme
#2,9868%
Core
#3141%

Breakdown by patch priority

High (Resolve immediately)
#6,22016%
Medium (Resolve in 14 days)
#7,70220%
Low (Resolve in 30 days)
#24,96664%

Breakdown by CVSS severity

Critical (9.0-10.0)
#2,4777%
High (7.0-8.9)
#11,41931%
Medium (4.0-6.9)
#22,32061%
Low (0.1-3.9)
#2091%

Top security researchers by contributions

See leaderboard
# Researcher
Reports
Country

Plugins with a VDP earn +15% XP and Zeroday payouts up to $33,000!

Read more