UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Critical 9.8

    CVE-2026-62003 · Mission (WordPress theme)

    WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  2. Critical 9.8

    CVE-2026-62002 · Meals Wheels (WordPress theme)

    WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  3. Critical 9.8

    CVE-2026-62001 · Marcell (WordPress theme)

    WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  4. Critical 9.8

    CVE-2026-61998 · Letruffe (WordPress theme)

    WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  5. Critical 9.8

    CVE-2026-61997 · Legal Stone (WordPress theme)

    WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  6. High 8.5

    CVE-2026-61996 · Mls On The Fly (WordPress plugin)

    WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  7. High 7.1

    CVE-2026-61995 · Youtube Showcase (WordPress plugin)

    WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  8. High 7.1

    CVE-2026-61993 · Blockonomics Bitcoin Payments (WordPress plugin)

    WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  9. Critical 9.8

    CVE-2026-61992 · Geo My WP (WordPress plugin)

    WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  10. Critical 10.0

    CVE-2026-61991 · Ajax Load More Cache (WordPress plugin)

    WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability

    Published 29 Oct 2026 · CVE Program
  11. High 7.1

    CVE-2026-61989 · Easy Property Listings (WordPress plugin)

    WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  12. High 7.1

    CVE-2026-61988 · Auction Nudge (WordPress plugin)

    WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  13. High 7.1

    CVE-2026-54866 · Razorpay Payment Button Elementor (WordPress plugin)

    WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  14. Medium 6.5

    CVE-2026-54865 · Podamibe Custom User Gravatar (WordPress plugin)

    WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  15. High 7.1

    CVE-2026-54864 · Video Playlist And Gallery Plugin (WordPress plugin)

    WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  16. Critical 9.8

    CVE-2026-54860 · Ozisti (WordPress theme)

    WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  17. Critical 9.8

    CVE-2026-54859 · Preservation (WordPress theme)

    WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  18. Critical 9.8

    CVE-2026-54858 · Printy (WordPress theme)

    WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  19. Critical 9.8

    CVE-2026-54857 · Quirky (WordPress theme)

    WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  20. Critical 9.8

    CVE-2026-54856 · Rexcoin (WordPress theme)

    WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  21. High 7.2

    CVE-2026-42701 · Yaymail (WordPress plugin)

    WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  22. High 7.1

    CVE-2026-42692 · WP Crowdfunding (WordPress plugin)

    WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  23. Medium 5.4

    CVE-2026-42690 · Learnpress (WordPress plugin)

    WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  24. High 7.1

    CVE-2026-27394 · Eventer (WordPress plugin)

    WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  25. High 7.1

    CVE-2026-118085 · Global Payments Woocommerce (WordPress plugin)

    WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  26. Medium 4.3

    CVE-2026-42694 · Kirki (WordPress plugin)

    WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  27. Medium 5.3

    CVE-2026-48200 · Document Library Lite (WordPress plugin)

    WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

    Published 29 Oct 2026 · CVE Program
  28. Medium 6.5

    CVE-2026-116848 · The Plus Addons For Elementor Page Builder (WordPress plugin)

    WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  29. Medium 6.4

    CVE-2026-109891 · Happy Elementor Addons (WordPress plugin)

    WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  30. Medium 4.3

    CVE-2026-25448 · Erp (WordPress plugin)

    WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  31. Medium 5.4

    CVE-2026-42691 · Eventprime Event Calendar Management (WordPress plugin)

    WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  32. Medium 5.3

    CVE-2026-54852 · Page And Post Restriction (WordPress plugin)

    WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  33. Medium 5.3

    CVE-2026-97073 · Mycred (WordPress plugin)

    WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  34. Medium 6.5

    CVE-2026-118097 · Html5 Video Player (WordPress plugin)

    WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  35. Medium 4.3

    CVE-2026-27062 · Wpfunnels (WordPress plugin)

    WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability

    Published 29 Oct 2026 · CVE Program
  36. Medium 5.3

    CVE-2026-54853 · Profile Builder (WordPress plugin)

    WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  37. Medium 6.5

    CVE-2026-114706 · Strong Testimonials (WordPress plugin)

    WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  38. Medium 5.3

    CVE-2026-27063 · Convertkit (WordPress plugin)

    WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  39. Medium 5.3

    CVE-2026-115601 · Custom Price For Woocommerce (WordPress plugin)

    WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  40. Medium 4.3

    CVE-2026-115605 · Suredash (WordPress plugin)

    WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  41. Medium 6.5

    CVE-2026-118095 · Media Library Assistant (WordPress plugin)

    WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  42. Medium 5.3

    CVE-2026-54871 · Shopbuilder (WordPress plugin)

    WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  43. Medium 5.3

    CVE-2026-25450 · User Registration (WordPress plugin)

    WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  44. Medium 6.5

    CVE-2026-116850 · Happy Elementor Addons (WordPress plugin)

    WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  45. Medium 5.3

    CVE-2026-114181 · Ecab Taxi Booking Manager (WordPress plugin)

    WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  46. Medium 5.3

    CVE-2026-118088 · Wpfunnels (WordPress plugin)

    WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  47. Medium 6.5

    CVE-2026-116849 · Streamcast (WordPress plugin)

    WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  48. Medium 6.5

    CVE-2026-110881 · Suredash (WordPress plugin)

    WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  49. Medium 5.3

    CVE-2026-116856 · Flexible Quantity Measurement Price Calculator For Woocommerce (WordPress plugin)

    WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  50. Medium 6.5

    CVE-2026-39737 · Jet Elements (WordPress plugin)

    WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.