pwn.watch: WordPress incident updates https://pwn.watch/s/wordpress Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 12:59:41 GMT [high] WordPress Core: WordPress Core Remote File Inclusion Vulnerability: CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28). https://pwn.watch/i/wordpress-core-cve-2026-87902 wordpress-core-cve-2026-87902:2026-09-25:CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28). Fri, 25 Sep 2026 00:00:00 GMT high Status: closed, patched [high] WordPress Core: WordPress Core SQL Injection Vulnerability: CISA added CVE-2026-60137, CVE-2026-63030 to the KEV catalog (due 2026-08-04). https://pwn.watch/i/wordpress-core-cve-2026-60137 wordpress-core-cve-2026-60137:2026-07-21:CISA added CVE-2026-60137, CVE-2026-63030 to the KEV catalog (due 2026-08-04). Tue, 21 Jul 2026 00:00:00 GMT high Status: closed, patched [high] WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability: CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03). https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940 webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940:2026-04-30:CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03). Thu, 30 Apr 2026 00:00:00 GMT high Status: closed, patched