CVE-2026-60137 CISA KEV · Actively exploited
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
CVSS score
5.9
EPSS probability
%5.3
Risk score
0.6
Published
3 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Open the CISA KEV active exploitation recordSimilar Vulnerabilities
8.1
CVE-2026-87902 Actively exploited
Vulnerability in WordPress
W
Workaround Public Exploits:7EPSS %40
9.8
CVE-2026-63030 Actively exploited
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
W
Workaround Public Exploits:1EPSS %11
8.8
CVE-2026-65640
Unrestricted file upload in WordPress
W
Patch status unknown Public Exploits:2EPSS %2
8.9
CVE-2026-64638
Cross-site scripting in WordPress
W
Patch status unknown Public Exploits:9EPSS %1
4.3
CVE-2023-39999
WordPress < 6.3.2 is vulnerable to Broken Access Control
W
Patch verifiedEPSS %1
-
CVE-2019-9978 Actively exploited
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
W
Workaround Public Exploits:11EPSS %73
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-60137"