#cisa

Patching & Vulnerabilities

WordPress CVE-2026-119977 is on CISA's KEV list: finish 7.1.4 now

On November 3, 2026 CISA added WordPress Core CVE-2026-119977 to its Known Exploited Vulnerabilities catalog. How home and personal-site owners confirm WordPress 7.1.4 (or the fixed backport) and check for a bad upgrade window.

Michael Narehood·Nov 4, 2026·6 min read