WPDeeply
Vulnerability Types
WordPress vulnerability classes explained with real disclosures.
A severity score tells you how bad something is. The vulnerability class tells you what an attacker can actually do with it — and that is what decides how fast you need to move.
The classes that matter in WordPress
- SQL injection — reading or writing your database through an unsanitised parameter.
- Cross-site scripting (XSS) — running JavaScript in an administrator’s browser.
- Cross-site request forgery (CSRF) — making a logged-in admin perform an action they never intended.
- Remote code execution (RCE) — running arbitrary PHP on your server.
Why the class changes your response
An authenticated stored XSS in a plugin only your editors can reach is a different problem from an unauthenticated SQL injection on a public login form, even at similar CVSS scores. The Loginizer issue documented in our 2020 disclosure was severe precisely because it needed no account and sat on a page every WordPress site exposes.