Is itCheck something

Attack list

WordPress

8 attacked bugs

Yes. Attackers are using WordPress bugs right now.

What to do

Ask whoever runs it (your web host or IT team) to install the vendor's latest security update now.

Attackers keep using these against anything that hasn't updated. Updating closes them.

BugConfirmed in attacks

  1. Hackers can take over WordPress sites while they updateCVE-2026-119977Nov 3, 2026
  2. Hackers can take over WordPress sites through a theme flawCVE-2026-87902Sep 25, 2026
  3. Hackers can inject database commands into WordPress sitesCVE-2026-60137Jul 21, 2026
  4. Hackers can take over WordPress sites through a web requestCVE-2026-63030Jul 21, 2026
  5. WebPros cPanel & WHM and WP2 (WordPress Squared) bug: & whm and wp2 (wordpress squared) missing authentication for critical functionCVE-2026-41940Apr 30, 2026
  6. WordPress File Manager Plugin bug: manager plugin remote code executionCVE-2020-25213Nov 3, 2021
  7. WordPress Snap Creek Duplicator Plugin bug: creek duplicator plugin file downloadCVE-2020-11738Nov 3, 2021
  8. WordPress Social Warfare Plugin bug: warfare plugin cross-site scripting (XSS)CVE-2019-9978Nov 3, 2021

From the US government's list of bugs confirmed in real attacks (CISA KEV). Check everything you use.