UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Critical 9.6

    CVE-2026-116863 · Newsletters Lite (WordPress plugin)

    WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability

    Published 27 Oct 2026 · CVE Program
  2. Medium 4.8

    CVE-2026-10752 · Acf Extended (WordPress plugin)

    Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field

    Published 27 Oct 2026 · CVE Program
  3. High 7.2

    CVE-2026-109995 · Acf Views (WordPress plugin)

    Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    Published 27 Oct 2026 · CVE Program
  4. Medium 6.4

    CVE-2026-10511 · Jupiterx Core (WordPress plugin)

    Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter

    Published 27 Oct 2026 · CVE Program
  5. High 8.8

    CVE-2026-75891 · Kirki (WordPress plugin)

    Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint

    Published 27 Oct 2026 · CVE Program
  6. High 7.2

    CVE-2026-111820 · Analytics Insights (WordPress plugin)

    Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title

    Published 27 Oct 2026 · CVE Program
  7. Medium 6.5

    CVE-2026-116408 · Photoblocks Grid Gallery (WordPress plugin)

    WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  8. Low 3.7

    CVE-2026-111404 · Woo Photo Reviews (WordPress plugin)

    WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability

    Published 26 Oct 2026 · CVE Program
  9. Medium 4.3

    CVE-2026-112839 · Woo Customer Coupons (WordPress plugin)

    WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability

    Published 26 Oct 2026 · CVE Program
  10. Medium 6.5

    CVE-2026-115966 · Text Typing (WordPress plugin)

    WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  11. Medium 6.5

    CVE-2026-116400 · Button Block (WordPress plugin)

    WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  12. Medium 6.5

    CVE-2026-116398 · Content Slider Block (WordPress plugin)

    WordPress Content Slider Block plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  13. Medium 6.5

    CVE-2026-116395 · Lightbox Block (WordPress plugin)

    WordPress LightBox Block plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  14. Medium 5.3

    CVE-2026-115598 · Learnpress (WordPress plugin)

    WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

    Published 26 Oct 2026 · CVE Program
  15. Medium 6.5

    CVE-2026-114710 · Photoblocks Grid Gallery (WordPress plugin)

    WordPress Gallery PhotoBlocks plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  16. Medium 5.4

    CVE-2026-115597 · Learnpress (WordPress plugin)

    WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

    Published 26 Oct 2026 · CVE Program
  17. Medium 5.3

    CVE-2026-116388 · Ameliabooking (WordPress plugin)

    WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

    Published 26 Oct 2026 · CVE Program
  18. Medium 6.5

    CVE-2026-116396 · Ameliabooking (WordPress plugin)

    WordPress Amelia plugin <= 2.4.12 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  19. Medium 5.9

    CVE-2026-116403 · Easy Digital Downloads (WordPress plugin)

    WordPress Easy Digital Downloads plugin <= 3.7.1 - Race Condition vulnerability

    Published 26 Oct 2026 · CVE Program
  20. Medium 5.3

    CVE-2026-116394 · Mage Eventpress (WordPress plugin)

    WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability

    Published 26 Oct 2026 · CVE Program
  21. Medium 6.5

    CVE-2026-114708 · Jet Smart Filters (WordPress plugin)

    WordPress JetSmartFilters plugin <= 3.8.6.1 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  22. Medium 5.3

    CVE-2026-115595 · Contact Form By Supsystic (WordPress plugin)

    WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability

    Published 26 Oct 2026 · CVE Program
  23. Medium 5.3

    CVE-2026-115959 · Woosquare (WordPress plugin)

    WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability

    Published 26 Oct 2026 · CVE Program
  24. Medium 4.3

    CVE-2026-115960 · Woosquare (WordPress plugin)

    WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability

    Published 26 Oct 2026 · CVE Program
  25. Medium 6.5

    CVE-2026-115955 · Advanced Post Block (WordPress plugin)

    WordPress Advanced Post Block - Post Grid for WordPress block editor plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  26. Medium 6.5

    CVE-2026-115956 · Panorama (WordPress plugin)

    WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  27. Medium 6.5

    CVE-2026-115961 · B Slider (WordPress plugin)

    WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  28. Medium 6.5

    CVE-2026-114707 · Jet Elements (WordPress plugin)

    WordPress JetElements For Elementor plugin <= 2.9.2.5 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  29. Medium 6.5

    CVE-2026-115594 · Media Library Assistant (WordPress plugin)

    WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability

    Published 26 Oct 2026 · CVE Program
  30. High 8.5

    CVE-2026-115608 · Jet Engine (WordPress plugin)

    WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability

    Published 26 Oct 2026 · CVE Program
  31. Medium 6.5

    CVE-2026-115953 · Geo Mashup (WordPress plugin)

    WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  32. Medium 5.4

    CVE-2026-115954 · Geo Mashup (WordPress plugin)

    WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability

    Published 26 Oct 2026 · CVE Program
  33. Medium 6.5

    CVE-2026-115950 · Better Post Filter Widgets For Elementor (WordPress plugin)

    WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  34. Medium 6.5

    CVE-2026-115951 · Lazy Load For Videos (WordPress plugin)

    WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  35. High 8.5

    CVE-2026-115948 · Media Library Assistant (WordPress plugin)

    WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability

    Published 26 Oct 2026 · CVE Program
  36. Medium 6.5

    CVE-2026-114709 · Ad Inserter (WordPress plugin)

    WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  37. Medium 6.5

    CVE-2026-115949 · Better Post Filter Widgets For Elementor (WordPress plugin)

    WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability

    Published 26 Oct 2026 · CVE Program
  38. Medium 5.3

    CVE-2026-115614 · Booking And Rental Manager For Woocommerce (WordPress plugin)

    WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability

    Published 26 Oct 2026 · CVE Program
  39. Medium 5.3

    CVE-2026-97255 · Royal Elementor Addons (WordPress plugin)

    WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability

    Published 26 Oct 2026 · CVE Program
  40. Medium 6.5

    CVE-2026-97254 · Royal Elementor Addons (WordPress plugin)

    WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  41. Medium 4.3

    CVE-2026-97295 · Media Library Assistant (WordPress plugin)

    WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability

    Published 26 Oct 2026 · CVE Program
  42. Medium 6.5

    CVE-2026-112865 · Royal Elementor Addons (WordPress plugin)

    WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  43. Medium 5.3

    CVE-2026-110377 · Bopo Woo Product Bundle Builder (WordPress plugin)

    WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability

    Published 26 Oct 2026 · CVE Program
  44. Medium 6.5

    CVE-2026-115602 · Kadence Blocks (WordPress plugin)

    WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  45. Medium 6.5

    CVE-2026-115613 · 3d Image Gallery (WordPress plugin)

    WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

    Published 26 Oct 2026 · CVE Program
  46. Medium 5.3

    CVE-2026-115958 · WP Discussion Board (WordPress plugin)

    WordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability

    Published 26 Oct 2026 · CVE Program
  47. Medium 4.3

    CVE-2026-110376 · Depart Deposit And Part Payment For Woo (WordPress plugin)

    WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability

    Published 26 Oct 2026 · CVE Program
  48. High 8.8

    CVE-2026-111841 · WP Marketing Automations (WordPress plugin)

    WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability

    Published 26 Oct 2026 · CVE Program
  49. Medium 4.3

    CVE-2026-112828 · AI Engine (WordPress plugin)

    WordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability

    Published 26 Oct 2026 · CVE Program
  50. Medium 5.3

    CVE-2026-116107 · Datafeedr Product Sets (WordPress plugin)

    Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization

    Published 26 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.