UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 6.5

    CVE-2026-39739 · Header Footer Elementor (WordPress plugin)

    WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  2. Medium 5.3

    CVE-2026-52710 · Ithemeland Free Gifts For Woo (WordPress plugin)

    WordPress GIFTiT &#8211; Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerability

    Published 30 Oct 2026 · CVE Program
  3. Medium 5.3

    CVE-2026-62057 · Cf7 Styler For Divi (WordPress plugin)

    WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability

    Published 30 Oct 2026 · CVE Program
  4. Medium 6.5

    CVE-2026-62121 · Unlimited Elements For Elementor (WordPress plugin)

    WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability

    Published 30 Oct 2026 · CVE Program
  5. Medium 5.3

    CVE-2026-62122 · Booktics (WordPress plugin)

    WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  6. High 7.5

    CVE-2026-76012 · Nextgen Gallery (WordPress plugin)

    Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Upload

    Published 30 Oct 2026 · CVE Program
  7. Medium 6.4

    CVE-2026-119113 · Geodirectory (WordPress plugin)

    GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter

    Published 30 Oct 2026 · CVE Program
  8. Medium 6.4

    CVE-2026-115869 · Themify Builder (WordPress plugin)

    Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field

    Published 30 Oct 2026 · CVE Program
  9. Medium 5.4

    CVE-2026-109984 · Fv Wordpress Flowplayer (WordPress plugin)

    FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments

    Published 30 Oct 2026 · CVE Program
  10. High 7.2

    CVE-2026-112365 · Easyjobs (WordPress plugin)

    easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter

    Published 30 Oct 2026 · CVE Program
  11. Medium 6.5

    CVE-2026-115820 · Majestic Support (WordPress plugin)

    Majestic Support <= 1.2.2 - Authenticated (Subscriber+) SQL Injection via 'columns' Parameter

    Published 30 Oct 2026 · CVE Program
  12. High 7.4

    CVE-2026-118205 · Essential Addons For Elementor Lite (WordPress plugin)

    Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision

    Published 30 Oct 2026 · CVE Program
  13. Medium 4.3

    CVE-2026-109592 · Desktop Mode (WordPress plugin)

    OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via PATCH /files/placements/<id> on orphaned placements

    Published 30 Oct 2026 · CVE Program
  14. Medium 6.4

    CVE-2026-102918 · Redux Framework (WordPress plugin)

    Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id

    Published 30 Oct 2026 · CVE Program
  15. Medium 6.5

    CVE-2026-102905 · Ad Inserter (WordPress plugin)

    Ad Inserter <= 2.8.19 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter

    Published 30 Oct 2026 · CVE Program
  16. Medium 6.4

    CVE-2026-110533 · Fv Wordpress Flowplayer (WordPress plugin)

    FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes

    Published 30 Oct 2026 · CVE Program
  17. Medium 4.9

    CVE-2026-104739 · JS Support Ticket (WordPress plugin)

    JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter

    Published 30 Oct 2026 · CVE Program
  18. High 7.2

    CVE-2026-96894 · Erp (WordPress plugin)

    ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body

    Published 30 Oct 2026 · CVE Program
  19. High 7.5

    CVE-2026-97638 · Forminator (WordPress plugin)

    Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter

    Published 30 Oct 2026 · CVE Program
  20. Medium 6.5

    CVE-2026-118635 · Geodirectory (WordPress plugin)

    GeoDirectory <= 2.8.198 - Unauthenticated Shortcode Injection via 'pagination_info' Parameter

    Published 30 Oct 2026 · CVE Program
  21. High 7.5

    CVE-2026-107630 · Email Templates (WordPress plugin)

    Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter

    Published 30 Oct 2026 · CVE Program
  22. Medium 6.4

    CVE-2026-9239 · Meow Gallery (WordPress plugin)

    Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)

    Published 30 Oct 2026 · CVE Program
  23. Medium 4.7

    CVE-2026-116552 · Likebtn Like Button (WordPress plugin)

    Like Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header

    Published 30 Oct 2026 · CVE Program
  24. High 7.5

    CVE-2026-110305 · Acf Extended (WordPress plugin)

    Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection

    Published 30 Oct 2026 · CVE Program
  25. Medium 5.4

    CVE-2026-110001 · Fv Wordpress Flowplayer (WordPress plugin)

    FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute

    Published 30 Oct 2026 · CVE Program
  26. High 8.7

    CVE-2025-8574 · Database Cleaner (WordPress plugin)

    Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion

    Published 30 Oct 2026 · CVE Program
  27. Medium 6.5

    CVE-2026-13747 · Meow Gallery (WordPress plugin)

    Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint

    Published 30 Oct 2026 · CVE Program
  28. Medium 6.4

    CVE-2026-119176 · Cp Multi View Calendar (WordPress plugin)

    CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter

    Published 30 Oct 2026 · CVE Program
  29. Medium 5.4

    CVE-2026-119466 · Woosquare (WordPress plugin)

    WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) vulnerability

    Published 30 Oct 2026 · CVE Program
  30. High 8.8

    CVE-2026-65566 · AI Engine (WordPress plugin)

    WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability

    Published 30 Oct 2026 · CVE Program
  31. Medium 4.3

    CVE-2026-62055 · Event Tickets (WordPress plugin)

    WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  32. Medium 6.5

    CVE-2026-119365 · Media Player Addons For Elementor (WordPress plugin)

    WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  33. Medium 5.4

    CVE-2026-119367 · The Events Calendar (WordPress plugin)

    WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  34. Medium 5.4

    CVE-2026-62141 · Fluent Crm (WordPress plugin)

    WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  35. Medium 6.5

    CVE-2026-119369 · The Events Calendar (WordPress plugin)

    WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  36. Medium 5.3

    CVE-2026-119479 · Jetformbuilder (WordPress plugin)

    WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerability

    Published 30 Oct 2026 · CVE Program
  37. Medium 5.4

    CVE-2026-116407 · Webba Booking Lite (WordPress plugin)

    WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  38. Medium 5.3

    CVE-2026-119368 · The Events Calendar (WordPress plugin)

    WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  39. Medium 5.3

    CVE-2026-119482 · Jetformbuilder (WordPress plugin)

    WordPress JetFormBuilder plugin <= 3.6.7.1 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  40. Medium 5.3

    CVE-2026-116860 · Timetics (WordPress plugin)

    WordPress Timetics plugin <= 1.0.65 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  41. Medium 6.5

    CVE-2026-119370 · The Events Calendar (WordPress plugin)

    WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  42. Medium 6.5

    CVE-2026-65444 · Blocksy Companion (WordPress plugin)

    WordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  43. Medium 6.9

    CVE-2026-112348 · Kirki (WordPress plugin)

    Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token

    Published 30 Oct 2026 · Fixed in 6.2.5 · CVE Program
  44. High 7.2

    CVE-2026-112347 · Kirki (WordPress plugin)

    Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API

    Published 30 Oct 2026 · Fixed in 6.4.1 · CVE Program
  45. High 7.5

    CVE-2026-110732 · AI Engine (WordPress plugin)

    AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration

    Published 30 Oct 2026 · CVE Program
  46. High 7.2

    CVE-2026-116622 · Food Store (WordPress plugin)

    Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie

    Published 30 Oct 2026 · CVE Program
  47. High 8.8

    CVE-2026-89435 · Formidable (WordPress plugin)

    Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter

    Published 30 Oct 2026 · CVE Program
  48. Medium 4.3

    CVE-2026-119087 · Content Egg (WordPress plugin)

    Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter

    Published 30 Oct 2026 · CVE Program
  49. Medium 4.3

    CVE-2026-119059 · Content Egg (WordPress plugin)

    Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action

    Published 30 Oct 2026 · CVE Program
  50. Medium 6.4

    CVE-2026-118634 · Events Made Easy (WordPress plugin)

    Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute

    Published 30 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.