UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 6.4

    CVE-2026-118500 · Extensions For Elementor Form (WordPress plugin)

    Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter

    Published 30 Oct 2026 · CVE Program
  2. Medium 6.5

    CVE-2026-118698 · Joomsport Sports League Results Management (WordPress plugin)

    JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute

    Published 30 Oct 2026 · CVE Program
  3. Medium 6.5

    CVE-2026-118194 · Page And Post Restriction (WordPress plugin)

    Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication

    Published 30 Oct 2026 · CVE Program
  4. Medium 6.5

    CVE-2026-5461 · Forminator (WordPress plugin)

    Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata

    Published 30 Oct 2026 · CVE Program
  5. High 8.8

    CVE-2026-104368 · Users Customers Import Export For WP Woocommerce (WordPress plugin)

    Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field

    Published 30 Oct 2026 · CVE Program
  6. Low

    GHSA-4w3m-c66w-69mg · WordPress

    A race condition during core updates that could lead to remote code execution

    Published 29 Oct 2026 · Fixed in 6.9.11, 7.0.8, 7.1.4 · WordPress
  7. Medium

    GHSA-p2r6-rwjp-phv3 · WordPress

    An information disclosure issue exposing unpublished Customizer changes to unauthenticated visitors

    Published 29 Oct 2026 · Fixed in 6.9.11, 7.0.8, 7.1.4 · WordPress
  8. Low

    GHSA-vchg-92fx-636p · WordPress

    A permissions issue letting custom roles that moderate comments read, edit and delete notes on posts they can't edit

    Published 29 Oct 2026 · Fixed in 6.9.11, 7.0.8, 7.1.4 · WordPress
  9. Low

    GHSA-mqjw-vvgg-xfvf · WordPress

    An Editor+ stored cross-site scripting (XSS) issue in the personal data erasure requests screen

    Published 29 Oct 2026 · Fixed in 6.9.11, 7.0.8, 7.1.4 · WordPress
  10. Low

    GHSA-j3rg-rwgx-7wx7 · WordPress

    Unescaped usernames on the multisite Network Users screens, fixed as a hardening measure

    Published 29 Oct 2026 · Fixed in 6.9.11, 7.0.8, 7.1.4 · WordPress
  11. Medium

    GHSA-9vrg-x932-q57q · WordPress

    A Contributor+ stored cross-site scripting (XSS) issue in Customizer selective refresh

    Published 29 Oct 2026 · Fixed in 6.9.11, 7.0.8, 7.1.4 · WordPress
  12. Medium

    GHSA-j255-3x8q-7q7g · WordPress

    A Contributor+ stored cross-site scripting (XSS) issue in the labels of the Comments Pagination and Post Navigation Link blocks

    Published 29 Oct 2026 · Fixed in 6.9.11, 7.0.8, 7.1.4 · WordPress
  13. Medium

    GHSA-wjwj-p342-9fq7 · WordPress

    An issue allowing post content to shadow Script Module data with a matching element ID

    Published 29 Oct 2026 · Fixed in 6.9.11, 7.0.8, 7.1.4 · WordPress
  14. Medium

    GHSA-7q86-3j97-744j · WordPress

    A cross-site scripting (XSS) issue in the Categories block via format string injection

    Published 29 Oct 2026 · Fixed in 6.9.11, 7.0.8, 7.1.4 · WordPress
  15. Medium

    GHSA-2p22-wv7j-cvfv · WordPress

    A hardening fix for unsafe preg_replace() replacements in the Image and Playlist blocks

    Published 29 Oct 2026 · Fixed in 6.9.11, 7.0.8, 7.1.4 · WordPress
  16. High

    GHSA-83c2-c4pc-wmp3 · WordPress

    Contributor+ stored cross-site scripting (XSS) and denial of service issues in Interactivity API bindings

    Published 29 Oct 2026 · Fixed in 6.9.11, 7.0.8, 7.1.4 · WordPress
  17. Medium 6.5

    CVE-2026-118084 · Nd Booking (WordPress plugin)

    WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability

    Published 29 Oct 2026 · CVE Program
  18. High 7.5

    CVE-2026-118083 · WP Crowdfunding (WordPress plugin)

    WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability

    Published 29 Oct 2026 · CVE Program
  19. High 8.8

    CVE-2026-118082 · Buddyboss Platform (WordPress plugin)

    WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability

    Published 29 Oct 2026 · CVE Program
  20. High 8.8

    CVE-2026-118081 · Wd Instagram Feed (WordPress plugin)

    WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  21. High 8.8

    CVE-2026-118080 · Socialsnap (WordPress plugin)

    WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  22. High 7.2

    CVE-2026-118079 · Fv Wordpress Flowplayer (WordPress plugin)

    WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  23. High 7.2

    CVE-2026-118078 · Product Catalog Feed (WordPress plugin)

    WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  24. High 7.2

    CVE-2026-118077 · Sastra Essential Addons For Elementor (WordPress plugin)

    WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  25. High 8.8

    CVE-2026-118076 · Reepay Checkout Gateway (WordPress plugin)

    WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  26. High 8.8

    CVE-2026-118075 · WP Media Folders (WordPress plugin)

    WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  27. High 7.2

    CVE-2026-118074 · Finale Woocommerce Sales Countdown Timer Discount (WordPress plugin)

    WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  28. High 8.8

    CVE-2026-118073 · News Kit Elementor Addons (WordPress plugin)

    WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  29. High 7.2

    CVE-2026-116869 · Mypos Virtual For Woocommerce (WordPress plugin)

    WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  30. High 8.8

    CVE-2026-116868 · Bp Xprofile Custom Field Types (WordPress plugin)

    WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  31. High 8.8

    CVE-2026-116867 · Dynamic Qr Code (WordPress plugin)

    WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  32. High 8.8

    CVE-2026-116866 · Woo Conditional Product Fees For Checkout (WordPress plugin)

    WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  33. High 7.2

    CVE-2026-116865 · Zippy (WordPress plugin)

    WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  34. High 7.2

    CVE-2026-116864 · Wpcargo (WordPress plugin)

    WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  35. High 7.1

    CVE-2026-108494 · Chained Quiz (WordPress plugin)

    WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  36. Critical 9.8

    CVE-2026-62131 · Zoho Flow (WordPress plugin)

    WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  37. Critical 9.8

    CVE-2026-62018 · Gunslinger (WordPress theme)

    WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  38. Critical 9.8

    CVE-2026-62017 · Good Homes (WordPress theme)

    WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  39. Critical 9.8

    CVE-2026-62016 · Gamic (WordPress theme)

    WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  40. Critical 9.8

    CVE-2026-62015 · Gamezone (WordPress theme)

    WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  41. Critical 9.8

    CVE-2026-62014 · Emojination (WordPress theme)

    WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  42. Critical 9.8

    CVE-2026-62013 · Edge Decor (WordPress theme)

    WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  43. Critical 9.8

    CVE-2026-62012 · Coinpress (WordPress theme)

    WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  44. Critical 9.8

    CVE-2026-62011 · Bonbon (WordPress theme)

    WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  45. Critical 9.8

    CVE-2026-62010 · Avventure (WordPress theme)

    WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  46. Critical 9.8

    CVE-2026-62009 · Filmax (WordPress theme)

    WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  47. Critical 9.8

    CVE-2026-62008 · Orpheus (WordPress theme)

    WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  48. Critical 9.8

    CVE-2026-62006 · Nuts (WordPress theme)

    WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  49. Critical 9.8

    CVE-2026-62005 · Muzicon (WordPress theme)

    WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  50. Critical 9.8

    CVE-2026-62004 · Motorix (WordPress theme)

    WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.