roots/wordpress

The package has a long release history, frequent recent releases, clear licensing, and organization backing. Repository commits and security documentation are limited, but the current release activity and focused Composer packaging reduce abandonment concerns.

Latest 7.1.2

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Are you affected? Scan for Free

Health Score Breakdown

Repo commit activity

There were no commits and no active maintainers in the last 3 months, which weakens direct maintenance evidence. The 113 releases in the last year and current repository push partly compensate for this gap.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance-hygiene gap.

Security policy

The linked repository has no security policy, so its vulnerability-reporting process is not documented.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-477661 New roots/wordpress is vulnerable to Path Traversal in versions 7.1 - 7.1.1, 7.0 - 7.0.5, 6.9 - 6.9.8, 6.8 - 6.8.9, 6.7 - 6.7.8, 6.6 - 6.6.8, 6.5 - 6.5.11, 6.4 - 6.4.11, 6.3 - 6.3.11, 6.2 - 6.2.12, 6.1 - 6.1.13, 6.0 - 6.0.15, 5.9 - 5.9.17, 5.8 - 5.8.16, 5.7 - 5.7.18, 5.6 - 5.6.20 and 0.0.1 - 5.5.21.	0.0.1 - 5.5.215.6 - 5.6.205.7 - 5.7.18 +14 more	Critical
AIKIDO-2026-278073 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. New roots/wordpress is vulnerable to Remote Code Execution (RCE) in versions 7.1 - 7.1, 7.0 - 7.0.4, 6.9 - 6.9.7, 6.8 - 6.8.8, 6.7 - 6.7.7, 6.6 - 6.6.7, 6.5 - 6.5.10, 6.4 - 6.4.10, 6.3 - 6.3.10, 6.2 - 6.2.11, 6.1 - 6.1.12, 6.0 - 6.0.14, 5.9 - 5.9.16, 5.8 - 5.8.15, 5.7 - 5.7.17, 5.6 - 5.6.19, 5.5 - 5.5.20 and 0.0.1 - 5.4.21.	0.0.1 - 5.4.215.5 - 5.5.205.6 - 5.6.19 +15 more	Critical
AIKIDO-2026-201909 roots/wordpress is vulnerable to Cross-Site Scripting (XSS) in versions 7.1 - 7.1, 7.0 - 7.0.4, 6.9 - 6.9.7, 6.8 - 6.8.8, 6.7 - 6.7.7, 6.6 - 6.6.7, 6.5 - 6.5.10, 6.4 - 6.4.10, 6.3 - 6.3.10, 6.2 - 6.2.11, 6.1 - 6.1.12, 6.0 - 6.0.14, 5.9 - 5.9.16, 5.8 - 5.8.15, 5.7 - 5.7.17, 5.6 - 5.6.19, 5.5 - 5.5.20 and 5.4 - 5.4.21.	5.4 - 5.4.215.5 - 5.5.205.6 - 5.6.19 +15 more	High
AIKIDO-2026-48933 roots/wordpress is vulnerable to Remote Code Execution (RCE) in versions 7.0 - 7.0.3, 6.9 - 6.9.6, 6.8 - 6.8.7, 6.7 - 6.7.6, 6.6 - 6.6.6, 6.5 - 6.5.9, 6.4 - 6.4.9, 6.3 - 6.3.9, 6.2 - 6.2.10, 6.1 - 6.1.11, 6.0 - 6.0.13, 5.9 - 5.9.15, 5.8 - 5.8.14, 5.7 - 5.7.16, 5.6 - 5.6.18, 5.5 - 5.5.19, 5.4 - 5.4.20, 5.3 - 5.3.22 and 4.7 - 5.2.25.	4.7 - 5.2.255.3 - 5.3.225.4 - 5.4.20 +16 more	High
AIKIDO-2026-76686 roots/wordpress is vulnerable to Cross-Site Scripting (XSS) in versions 7.0 - 7.0.2, 6.9 - 6.9.5, 6.8 - 6.8.6, 6.7 - 6.7.5, 6.6 - 6.6.5, 6.5 - 6.5.8, 6.4 - 6.4.8, 6.3 - 6.3.8, 6.2 - 6.2.9, 6.1 - 6.1.10, 6.0 - 6.0.12, 5.9 - 5.9.13, 5.8 - 5.8.13, 5.7 - 5.7.15, 5.6 - 5.6.17, 5.5 - 5.5.18, 5.4 - 5.4.19, 5.3 - 5.3.21 and 3.7.38 - 5.2.24.	3.7.38 - 5.2.245.3 - 5.3.215.4 - 5.4.19 +16 more	High