Partly. CISA's Known Exploited Vulnerabilities catalog is a good urgent signal because every entry is confirmed exploited, and it comes as a JSON file you can filter. But it holds few WordPress items, so it cannot replace a feed that covers the many plugins on a typical site.
What the catalog is
CISA describes the KEV catalog as its authoritative list of vulnerabilities exploited in the wild, and advises organisations to use it as an input to their vulnerability management prioritisation. It is available as CSV and as JSON.
That makes it a prioritisation tool. Inclusion means attackers have used the flaw, which is a stronger signal than a severity score alone. It does not mean the catalog lists every risky plugin.
How small the WordPress slice is
The JSON feed release dated 16 October 2026 held 1,748 entries. Filtering on the vendor project field set to WordPress returned six: three for WordPress core and three for plugins. One further entry named a hosting control panel product with WordPress in its product name. Counts change as CISA adds entries, so rerun the filter rather than quoting this number.
Each entry has fields including the CVE identifier, vendor and product, a short description, the date added, a required action and a due date. Those fields are enough to build a simple match.
How to use it for a WordPress estate
- Download the JSON on a schedule.
- Filter for WordPress in the vendor and product fields, and add the names of your key plugins.
- Match entries against your inventory of core version, plugins and themes.
- For any match, treat the due date as your own deadline and update or remove the component.
- Log what you did, with a date.
What it will miss
| Gap | Why |
|---|---|
| Vulnerable but not yet exploited plugins | Not in the catalog until exploitation is confirmed |
| Small plugins | Few get listed |
| Premium plugins | Coverage depends on public reporting |
| Your custom code | Never listed |
So pair it with a feed that covers plugin vulnerabilities broadly, and with your own inventory. The catalog answers one question: which known issues must be fixed first. It does not answer which components you run.
A simple review habit
Put a recurring slot in the calendar, weekly for agencies and monthly for single sites, to refresh the file, rerun the filter and record the result even when nothing matches. A dated note that says no match this week is useful evidence that someone looked.
Make the inventory the foundation
Matching only works if you know your versions. Build the inventory first, then filter any feed against it. Safeguard can scan a repository for dependency manifests and produce an SBOM, and there is a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how an exploited-in-the-wild signal changes what you fix first.
Quick check
Is every exploited WordPress plugin in the KEV catalog?
No. Entries depend on confirmed exploitation and CISA's criteria, so many exploited issues may be absent.
Is the KEV feed free?
CISA publishes it for public download as CSV and JSON.
Sources
Last reviewed: 19 October 2026.
