Summary iPlain-English security verdict for WordPress, generated from its current health score, actively-exploited vulnerabilities, and latest supported version.
WordPress currently scores 100/100 — healthy. 2 actively-exploited vulnerabilities (CISA KEV) affect older releases (e.g. CVE-2026-63030) — staying on the latest supported version keeps you clear of them. The latest supported release is 7.0.2. It's on the latest patch with no significant known issues — keep it current.
Disclosure trend iNew CVEs published for WordPress each year (NVD). A higher bar means more disclosures that year — more scrutiny, not necessarily less safe.
Patch priority — what to act on iThe issues to fix first — actively exploited (CISA KEV) first, then by exploitation probability (EPSS), then severity. Each row's "→ fixed in" is the earliest version that patches it; "see advisory" means no fixed version is published.
Most urgent first — actively exploited, then likeliest to be exploited.
CVE-2026-63030 CRITICAL exploited CWE-436 EPSS 39% → fixed in 7.0.2 CVE-2026-60137 MEDIUM exploited SQL injection EPSS 4% → fixed in 7.0.2How to patch WordPress — step-by-step to the latest secure version →
Get alerted about WordPress
Be emailed the moment WordPress gets a newly exploited vulnerability (CISA KEV) or a release reaches end of life. Free · double opt-in · unsubscribe anytime.
We email only on real events for WordPress — no marketing, no sharing, and we never know what you run. Track your whole stack →
Versions & lifecycle iWhen each release line stops receiving security patches (end-of-life). After EOL there are no more fixes — plan upgrades before these dates.
How long each WordPress release line is supported — and when it sunsets. Select a line for its full report.
Full WordPress end-of-life dates & support timeline →
7.0 latest 7.0.2 Supported 7.0.2 → 6.9 latest 6.9.5 End of life ended 2026-05-206.9.5 → 6.8 latest 6.8.6 End of life ended 2025-12-026.8.6 → 6.7 latest 6.7.5 End of life ended 2025-04-156.7.5 → 6.6 latest 6.6.5 End of life ended 2024-11-126.6.5 → 6.5 latest 6.5.8 End of life ended 2024-07-166.5.8 → 6.4 latest 6.4.8 End of life ended 2024-04-026.4.8 → 6.3 latest 6.3.8 End of life ended 2023-11-076.3.8 → 6.2 latest 6.2.9 End of life ended 2023-08-086.2.9 → 6.1 latest 6.1.10 End of life ended 2023-03-296.1.10 → See all upcoming end-of-life dates →Frequently asked
Is WordPress safe and patched?
WordPress currently scores 100/100 — healthy. 2 actively-exploited vulnerabilities (CISA KEV) affect older releases (e.g. CVE-2026-63030) — staying on the latest supported version keeps you clear of them. The latest supported release is 7.0.2. It's on the latest patch with no significant known issues — keep it current.
What should I do about WordPress now?
Upgrade WordPress to the latest supported release (7.0.2) or later, which clears the actively-exploited issues affecting older versions, then confirm against WordPress's official advisory.
When does WordPress reach end-of-life?
The latest supported WordPress release is 7.0.2. After end-of-life a release no longer receives security patches.
Which versions of WordPress are still receiving security updates?
Supported WordPress release lines (latest 7.0.2): 7.0. End-of-life releases no longer receive security patches.
Latest security news for WordPress BETA
Attributed third-party reporting linked to WordPress — newest first. We surface and link the source; we don’t assert our own findings. About Emerging →
More across all tracked software on the Emerging feed →
Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against WordPress's official advisory before you patch or upgrade — WordPress official site ↗