Verified Advisories

Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 2 total.

Severity: All Critical High

Library: wordpress

wordpress 2 CVEs from one advisory advisory

CVE-2026-60137 MEDIUM CVSS 5.9 Verified Advisory Jul 17, 2026

SQL injection in WordPress core WP_Query author__not_in parameter (CVE-2026-60137)

WordPress core does not properly sanitise the `author__not_in` parameter of `WP_Query`; when a plugin or theme passes untrusted input to this parameter as a string rather than an array, the type-check is bypassed and ...

Fixed in 6.8.6; 6.9.5; 7.0.2

SQLi WordPress

CVE-2026-63030 CRITICAL CVSS 9.8 Verified Advisory Jul 17, 2026

REST API batch endpoint route confusion in WordPress (CVE-2026-63030)

CVE-2026-63030 is a route confusion flaw in the WordPress REST API batch endpoint (/wp-json/batch/v1) that causes two parallel tracking arrays to fall out of step when a sub-request errors, allowing a subsequent reque...

Fixed in 6.9.5; 7.0.2

RCE SQLi WordPress