WordPress.org
Security Scorecard
Score
34D
Total CVEs
896
Patch Rate
47%
419 patched
Avg Response
104d
days to patch
Critical Gaps
8
exploitable, no detection
Severity Breakdown
Critical39
High157
Medium698
Low2
Patch Status
Patched419 (47%)
Partial/Workaround4 (0%)
Unpatched473 (53%)
CVEs (1,108)
| CVE ID | Title | Severity | Score | Days | Patch |
|---|---|---|---|---|---|
| CVE-2025-11769 | - | Medium | 6.4 | 32d | Unpatched |
| CVE-2025-12681 | - | Medium | 5.3 | 32d | Unpatched |
| CVE-2025-12536 | - | Medium | 5.3 | 32d | Unpatched |
| CVE-2025-12366 | - | Medium | 4.3 | 32d | Unpatched |
| CVE-2025-64271 | WP Plugin Manager CSRF Vulnerability | Medium | 6.5 | 69d | Unpatched |
| CVE-2025-64292 | Germanized Google Analytics Cross-Site Scripting Vulnerability | Medium | 5.4 | 69d | Unpatched |
| CVE-2025-64369 | Contact Form Email Vulnerability | Medium | 6.5 | 69d | Unpatched |
| CVE-2025-64381 | WordPress Booking Calendar Plugin Cross-site Scripting Vulnerability | Medium | 6.5 | 69d | Unpatched |
| CVE-2025-11454 | - | Medium | 6.5 | 33d | Unpatched |
| CVE-2025-12732 | - | Medium | 4.3 | 33d | Unpatched |