UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 5.1

    CVE-2026-118989 · Product Import Export For Woo (WordPress plugin)

    WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 SSRF via Redirects

    Published 29 Oct 2026 · Fixed in 2.6.8 · CVE Program
  2. Medium 5.4

    CVE-2026-111318 · Ht Mega For Elementor (WordPress plugin)

    HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink

    Published 29 Oct 2026 · CVE Program
  3. High 7.2

    CVE-2026-107743 · Mapster WP Maps (WordPress plugin)

    Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter

    Published 29 Oct 2026 · CVE Program
  4. Medium 5.3

    CVE-2026-91153 · Everest Forms (WordPress plugin)

    Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})

    Published 29 Oct 2026 · CVE Program
  5. Medium 6.4

    CVE-2026-104727 · Sequential Order Numbers For Woocommerce (WordPress plugin)

    Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys

    Published 29 Oct 2026 · CVE Program
  6. Medium 6.1

    CVE-2026-91152 · Everest Forms (WordPress plugin)

    Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter

    Published 29 Oct 2026 · CVE Program
  7. Medium 5.4

    CVE-2026-107627 · Greenshift Animation And Page Builder Blocks (WordPress plugin)

    Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block

    Published 29 Oct 2026 · CVE Program
  8. Medium 5.4

    CVE-2026-107629 · Greenshift Animation And Page Builder Blocks (WordPress plugin)

    Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText

    Published 29 Oct 2026 · CVE Program
  9. Medium 4.7

    CVE-2026-110707 · Feedzy Rss Feeds (WordPress plugin)

    RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element

    Published 29 Oct 2026 · CVE Program
  10. Medium 4.7

    CVE-2026-103875 · Media Library Assistant (WordPress plugin)

    Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links

    Published 29 Oct 2026 · CVE Program
  11. Medium 6.5

    CVE-2026-118192 · Joomsport Sports League Results Management (WordPress plugin)

    JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute

    Published 29 Oct 2026 · CVE Program
  12. Medium 5.4

    CVE-2026-103485 · Extensions Leaflet Map (WordPress plugin)

    Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property

    Published 29 Oct 2026 · CVE Program
  13. High 7.5

    CVE-2026-93757 · Wild Apricot Login (WordPress plugin)

    Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite

    Published 29 Oct 2026 · CVE Program
  14. High 8.1

    CVE-2026-96228 · SSL Wireless SMS Notification (WordPress plugin)

    SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeover

    Published 29 Oct 2026 · CVE Program
  15. High 7.2

    CVE-2026-96666 · Schema App Structured Data For Schemaorg (WordPress plugin)

    Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter

    Published 29 Oct 2026 · CVE Program
  16. High 7.5

    CVE-2026-93904 · Social Web Suite (WordPress plugin)

    Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter

    Published 29 Oct 2026 · CVE Program
  17. High 7.5

    CVE-2026-93855 · Sendpress (WordPress plugin)

    SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter

    Published 29 Oct 2026 · CVE Program
  18. High 7.2

    CVE-2026-96669 · Food Store (WordPress plugin)

    Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie

    Published 29 Oct 2026 · CVE Program
  19. High 7.2

    CVE-2026-96741 · Dsgvo All In One For WP (WordPress plugin)

    DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption

    Published 29 Oct 2026 · CVE Program
  20. Critical 9.8

    CVE-2026-109516 · Bot For Telegram On Woocommerce (WordPress plugin)

    Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token

    Published 29 Oct 2026 · CVE Program
  21. Medium 6.9

    CVE-2026-118757 · Disable Payment Method For Woocommerce (WordPress plugin)

    PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees

    Published 28 Oct 2026 · Fixed in 1.1.10.9 · CVE Program
  22. Medium 5.1

    CVE-2026-67187 · Ninja Forms (WordPress plugin)

    Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields

    Published 28 Oct 2026 · Fixed in 3.15.4 · CVE Program
  23. High 8.5

    CVE-2026-115603 · Advanced Ads Tracking (WordPress plugin)

    WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability

    Published 28 Oct 2026 · Fixed in 4.0.0 · CVE Program
  24. Critical 9.8

    CVE-2026-115968 · Ultimate Member (WordPress plugin)

    WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability

    Published 28 Oct 2026 · CVE Program
  25. High 7.2

    CVE-2026-116390 · Filter Everything (WordPress plugin)

    WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability

    Published 28 Oct 2026 · CVE Program
  26. High 8.8

    CVE-2026-116389 · Phoenix Media Rename (WordPress plugin)

    WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability

    Published 28 Oct 2026 · CVE Program
  27. High 7.2

    CVE-2026-115590 · Dokan Lite (WordPress plugin)

    WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability

    Published 28 Oct 2026 · CVE Program
  28. High 8.8

    CVE-2026-116391 · Gs Logo Slider (WordPress plugin)

    WordPress GS Logo Slider plugin <= 3.8.9 - PHP Object Injection vulnerability

    Published 28 Oct 2026 · CVE Program
  29. High 7.2

    CVE-2026-116392 · Accordions (WordPress plugin)

    WordPress Accordion plugin <= 2.3.25 - PHP Object Injection vulnerability

    Published 28 Oct 2026 · CVE Program
  30. High 7.5

    CVE-2026-116393 · Optima Express (WordPress plugin)

    WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability

    Published 28 Oct 2026 · CVE Program
  31. Medium 6.5

    CVE-2026-116404 · Redux Framework (WordPress plugin)

    WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability

    Published 28 Oct 2026 · CVE Program
  32. High 8.5

    CVE-2026-111850 · Buddypress (WordPress plugin)

    WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability

    Published 28 Oct 2026 · CVE Program
  33. High 7.1

    CVE-2026-115612 · Slicewp (WordPress plugin)

    WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability

    Published 28 Oct 2026 · CVE Program
  34. High 7.5

    CVE-2026-115591 · Contact Form By Supsystic (WordPress plugin)

    WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerability

    Published 28 Oct 2026 · CVE Program
  35. High 7.1

    CVE-2026-115593 · Unlimited Elements For Elementor (WordPress plugin)

    WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability

    Published 28 Oct 2026 · CVE Program
  36. High 7.1

    CVE-2026-115596 · Ecommerce Product Catalog (WordPress plugin)

    WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability

    Published 28 Oct 2026 · CVE Program
  37. Critical 9.3

    CVE-2026-111411 · WP Marketing Automations (WordPress plugin)

    WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability

    Published 28 Oct 2026 · CVE Program
  38. Critical 9.3

    CVE-2026-115607 · Dxp Toolkit (WordPress plugin)

    WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability

    Published 28 Oct 2026 · CVE Program
  39. Medium 6.5

    CVE-2026-115957 · WP Discussion Board (WordPress plugin)

    WordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability

    Published 28 Oct 2026 · CVE Program
  40. High 7.1

    CVE-2026-115606 · Dxp Toolkit (WordPress plugin)

    WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

    Published 28 Oct 2026 · CVE Program
  41. High 7.1

    CVE-2026-115609 · Invoicing (WordPress plugin)

    WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability

    Published 28 Oct 2026 · CVE Program
  42. Medium 5.4

    CVE-2026-116855 · My Auctions Allegro Free Edition (WordPress plugin)

    WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability

    Published 28 Oct 2026 · CVE Program
  43. Medium 4.3

    CVE-2026-85655 · Enable Media Replace (WordPress plugin)

    Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow

    Published 28 Oct 2026 · CVE Program
  44. Medium 6.1

    CVE-2026-101935 · Echo Knowledge Base (WordPress plugin)

    Echo Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' Parameter

    Published 28 Oct 2026 · CVE Program
  45. Medium 6.4

    CVE-2026-109975 · Cozy Addons (WordPress plugin)

    Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute

    Published 28 Oct 2026 · CVE Program
  46. Medium 6.5

    CVE-2026-76005 · WP Inventory Manager (WordPress plugin)

    WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute

    Published 28 Oct 2026 · CVE Program
  47. Medium 4.9

    CVE-2026-118169 · Wordpress Popup (WordPress plugin)

    Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter

    Published 28 Oct 2026 · CVE Program
  48. Medium 4.9

    CVE-2026-104743 · Tainacan (WordPress plugin)

    Tainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment

    Published 28 Oct 2026 · CVE Program
  49. Medium 6.3

    CVE-2026-76780 · Beyondseo (WordPress plugin)

    BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalation

    Published 28 Oct 2026 · CVE Program
  50. Medium 5.9

    CVE-2026-110185 · Bit Pi (WordPress plugin)

    Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters

    Published 28 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.