UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 5.3

    CVE-2026-118091 · Wpfunnels (WordPress plugin)

    WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  2. Medium 5.3

    CVE-2026-116387 · Sureforms (WordPress plugin)

    WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  3. Medium 6.5

    CVE-2026-39742 · Kadence Blocks (WordPress plugin)

    WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  4. Medium 6.5

    CVE-2026-115610 · Publishpress Authors (WordPress plugin)

    WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  5. Medium 4.3

    CVE-2026-118092 · Masterstudy Lms Learning Management System (WordPress plugin)

    WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  6. Medium 4.3

    CVE-2026-116406 · Webba Booking Lite (WordPress plugin)

    WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  7. Medium 4.3

    CVE-2026-52708 · WP User Frontend (WordPress plugin)

    WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  8. Medium 5.3

    CVE-2026-116846 · WP User Manager (WordPress plugin)

    WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  9. Medium 5.3

    CVE-2026-48884 · WP User Frontend (WordPress plugin)

    WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  10. Medium 5.3

    CVE-2026-80069 · Masterstudy Lms Learning Management System (WordPress plugin)

    MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax

    Published 29 Oct 2026 · Fixed in 3.7.50 · CVE Program
  11. Medium 5.3

    CVE-2026-80067 · Masterstudy Lms Learning Management System (WordPress plugin)

    MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter

    Published 29 Oct 2026 · Fixed in 3.7.50 · CVE Program
  12. High 8.5

    CVE-2026-39736 · Jet Engine (WordPress plugin)

    WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  13. Medium 5.3

    CVE-2026-116402 · Sureforms (WordPress plugin)

    WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  14. Medium 5.3

    CVE-2026-48202 · Brave Popup Builder (WordPress plugin)

    WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  15. Medium 5.3

    CVE-2026-39782 · Kali Forms (WordPress plugin)

    WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  16. Medium 5.3

    CVE-2026-25467 · User Registration (WordPress plugin)

    WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  17. High 8.8

    CVE-2026-116399 · Instawp Connect (WordPress plugin)

    WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability

    Published 29 Oct 2026 · CVE Program
  18. Medium 6.5

    CVE-2026-116857 · Jet Smart Filters (WordPress plugin)

    WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  19. Medium 6.5

    CVE-2026-54862 · Import Users From Csv With Meta (WordPress plugin)

    WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  20. Medium 5.1

    CVE-2026-119054 · Multiple Pages Generator By Porthas (WordPress plugin)

    Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url

    Published 29 Oct 2026 · Fixed in 4.2.5 · CVE Program
  21. Medium 4.3

    CVE-2026-42707 · Hivepress Claim Listings (WordPress plugin)

    WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  22. Medium 6.5

    CVE-2026-48195 · PDF Poster (WordPress plugin)

    WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  23. Medium 5.3

    CVE-2026-39741 · Simple Cloudflare Turnstile (WordPress plugin)

    WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  24. Medium 6.5

    CVE-2026-48196 · Kali Forms (WordPress plugin)

    WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  25. Medium 4.3

    CVE-2026-22386 · WP Job Portal (WordPress plugin)

    WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  26. Medium 6.5

    CVE-2026-52709 · Video Gallery Block (WordPress plugin)

    WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  27. Medium 6.5

    CVE-2026-24533 · Cozy Addons (WordPress plugin)

    WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  28. Medium 6.5

    CVE-2026-42703 · Kali Forms (WordPress plugin)

    WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  29. Medium 6.5

    CVE-2026-118087 · Site Reviews (WordPress plugin)

    WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  30. Medium 6.5

    CVE-2026-118094 · Ad Inserter (WordPress plugin)

    WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  31. Medium 6.5

    CVE-2026-39735 · Jet Engine (WordPress plugin)

    WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  32. Medium 6.5

    CVE-2026-56056 · The Post Grid (WordPress plugin)

    WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  33. Medium 5.3

    CVE-2026-118093 · Best Woocommerce Feed (WordPress plugin)

    WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  34. Medium 5.3

    CVE-2026-27401 · Yith Paypal Express Checkout For Woocommerce (WordPress plugin)

    WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  35. High 7.2

    CVE-2026-115821 · Newsmanapp (WordPress plugin)

    NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters

    Published 29 Oct 2026 · CVE Program
  36. High 7.5

    CVE-2026-110184 · Newsmatic (WordPress theme)

    Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter

    Published 29 Oct 2026 · CVE Program
  37. Medium 5.3

    CVE-2026-92086 · Mw WP Form (WordPress plugin)

    MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter

    Published 29 Oct 2026 · CVE Program
  38. Medium 4.9

    CVE-2026-109216 · Meta Box (WordPress plugin)

    Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys

    Published 29 Oct 2026 · CVE Program
  39. High 7.2

    CVE-2026-96767 · Nex Forms Express WP Form Builder (WordPress plugin)

    NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header

    Published 29 Oct 2026 · CVE Program
  40. High 7.1

    CVE-2026-115611 · Posts Table Filterable (WordPress plugin)

    WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  41. Critical 9.3

    CVE-2026-115964 · Motors Car Dealership Classified Listings (WordPress plugin)

    WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  42. Medium 4.3

    CVE-2026-115962 · Mycred (WordPress plugin)

    WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability

    Published 29 Oct 2026 · CVE Program
  43. High 7.1

    CVE-2026-115592 · Oceanwp (WordPress plugin), Oceanwp (WordPress theme)

    WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  44. High 7.1

    CVE-2026-116409 · Upsell Order Bump Offer For Woocommerce (WordPress plugin)

    WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability

    Published 29 Oct 2026 · CVE Program
  45. High 7.1

    CVE-2026-112827 · Handmade Dropshipping For Etsy And Woo (WordPress plugin)

    WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  46. High 7.5

    CVE-2026-114193 · Geo My WP (WordPress plugin)

    WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  47. High 7.5

    CVE-2026-115599 · Learnpress (WordPress plugin)

    WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program
  48. High 8.5

    CVE-2026-115965 · Buddypress (WordPress plugin)

    WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

    Published 29 Oct 2026 · CVE Program
  49. High 8.8

    CVE-2026-115967 · Login With Phone Number (WordPress plugin)

    WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability

    Published 29 Oct 2026 · CVE Program
  50. High 7.1

    CVE-2026-115963 · Videowhisper Live Streaming Integration (WordPress plugin)

    WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability

    Published 29 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.