UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 7.5

    CVE-2026-114191 · Upi Qr Code Payment For Woocommerce (WordPress plugin)

    WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability

    Published 24 Oct 2026 · CVE Program
  2. High 7.2

    CVE-2026-114704 · Relevanssi (WordPress plugin)

    WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability

    Published 24 Oct 2026 · CVE Program
  3. Medium 6.5

    CVE-2026-114192 · Mage Eventpress (WordPress plugin)

    WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability

    Published 24 Oct 2026 · CVE Program
  4. High 8.8

    CVE-2026-110018 · Ablocks (WordPress plugin)

    aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute

    Published 24 Oct 2026 · CVE Program
  5. Medium 6.5

    CVE-2026-114705 · Insta Gallery (WordPress plugin)

    WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability

    Published 24 Oct 2026 · CVE Program
  6. Medium 6.5

    CVE-2026-114194 · Ad Inserter (WordPress plugin)

    WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

    Published 24 Oct 2026 · CVE Program
  7. Critical 9.8

    CVE-2026-114196 · Paytium (WordPress plugin)

    WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability

    Published 24 Oct 2026 · CVE Program
  8. High 7.1

    CVE-2026-114695 · Vod Infomaniak (WordPress plugin)

    WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability

    Published 24 Oct 2026 · CVE Program
  9. High 7.1

    CVE-2026-114694 · Events Manager (WordPress plugin)

    WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability

    Published 24 Oct 2026 · CVE Program
  10. Medium 6.5

    CVE-2026-114693 · All In One Video Gallery (WordPress plugin)

    WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability

    Published 24 Oct 2026 · CVE Program
  11. Medium 6.5

    CVE-2026-110892 · Suredash (WordPress plugin)

    WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

    Published 24 Oct 2026 · CVE Program
  12. High 7.1

    CVE-2026-114697 · Qa Heatmap Analytics (WordPress plugin)

    WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability

    Published 24 Oct 2026 · CVE Program
  13. Critical 9.3

    CVE-2026-112866 · Woo Product Filter (WordPress plugin)

    WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability

    Published 24 Oct 2026 · CVE Program
  14. Critical 9.8

    CVE-2026-94075 · Newsletters Lite (WordPress plugin)

    WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability

    Published 24 Oct 2026 · CVE Program
  15. High 7.1

    CVE-2026-112869 · Opening Hours (WordPress plugin)

    WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability

    Published 24 Oct 2026 · CVE Program
  16. Critical 9.3

    CVE-2026-111402 · Newsletters Lite (WordPress plugin)

    WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

    Published 24 Oct 2026 · CVE Program
  17. High 7.1

    CVE-2026-112844 · WP Event Solution (WordPress plugin)

    WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability

    Published 24 Oct 2026 · CVE Program
  18. High 7.1

    CVE-2026-114179 · Bp Better Messages (WordPress plugin)

    WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

    Published 24 Oct 2026 · CVE Program
  19. Critical 9.8

    CVE-2026-115806 · Prime Mover (WordPress plugin)

    Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace

    Published 24 Oct 2026 · CVE Program
  20. High 7.1

    CVE-2026-115807 · Profile Builder (WordPress plugin)

    User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute

    Published 24 Oct 2026 · CVE Program
  21. Critical 9.8

    CVE-2026-112848 · Hostmev2 (WordPress plugin), Hostmev2 (WordPress theme)

    WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  22. High 7.1

    CVE-2026-112849 · Hostmev2 (WordPress plugin), Hostmev2 (WordPress theme)

    WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability

    Published 23 Oct 2026 · CVE Program
  23. High 8.1

    CVE-2026-112850 · Your Dress (WordPress theme)

    WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability

    Published 23 Oct 2026 · CVE Program
  24. Critical 9.8

    CVE-2026-112854 · Holistic Center (WordPress theme)

    WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  25. Critical 9.8

    CVE-2026-112847 · Zensoul (WordPress theme)

    WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  26. Critical 9.8

    CVE-2026-112846 · Save Life (WordPress theme)

    WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  27. Critical 9.8

    CVE-2026-112851 · Hotlock (WordPress theme)

    WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  28. High 8.1

    CVE-2026-112852 · Helion (WordPress theme)

    WordPress Helion theme <= 1.1.12 - PHP Object Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  29. Critical 9.8

    CVE-2026-112853 · Hallelujah (WordPress theme)

    WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  30. Critical 9.8

    CVE-2026-112856 · Vagabonds (WordPress theme)

    WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  31. Critical 9.8

    CVE-2026-112857 · Reprizo (WordPress plugin), Reprizo (WordPress theme)

    WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  32. Critical 9.8

    CVE-2026-112858 · Rhodos (WordPress theme)

    WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  33. Critical 9.8

    CVE-2026-112859 · Little Birdies (WordPress theme)

    WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  34. Critical 9.8

    CVE-2026-112855 · Redy (WordPress theme)

    WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  35. High 7.1

    CVE-2026-112863 · Kallyas (WordPress theme)

    WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability

    Published 23 Oct 2026 · CVE Program
  36. Critical 9.3

    CVE-2026-112860 · Participants Database (WordPress plugin)

    WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  37. Critical 9.8

    CVE-2026-112862 · Participants Database (WordPress plugin)

    WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  38. High 7.1

    CVE-2026-112835 · Vikrentcar (WordPress plugin)

    WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

    Published 23 Oct 2026 · CVE Program
  39. High 8.5

    CVE-2026-112837 · Gamipress (WordPress plugin)

    WordPress GamiPress plugin <= 8.0.7 - SQL Injection vulnerability

    Published 23 Oct 2026 · CVE Program
  40. High 7.5

    CVE-2026-112359 · Wpappninja (WordPress plugin)

    WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability

    Published 23 Oct 2026 · CVE Program
  41. High 7.1

    CVE-2026-112838 · Vikrentcar (WordPress plugin)

    WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

    Published 23 Oct 2026 · CVE Program
  42. Medium 6.5

    CVE-2026-112821 · Knit Pay (WordPress plugin)

    WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability

    Published 23 Oct 2026 · CVE Program
  43. Medium 6.5

    CVE-2026-112825 · Car Rental Manager (WordPress plugin)

    WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability

    Published 23 Oct 2026 · CVE Program
  44. High 7.2

    CVE-2026-109198 · Cleantalk Spam Protect (WordPress plugin)

    Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter

    Published 23 Oct 2026 · CVE Program
  45. High 7.5

    CVE-2026-115497 · Music Store (WordPress plugin)

    Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter

    Published 23 Oct 2026 · CVE Program
  46. High 8.6

    CVE-2026-104068 · Backup (WordPress plugin)

    JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore

    Published 22 Oct 2026 · Fixed in 3.1.24.10 · CVE Program
  47. Critical 9.8

    CVE-2026-112832 · Rootblox (WordPress plugin)

    WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability

    Published 22 Oct 2026 · CVE Program
  48. Medium 6.5

    CVE-2026-112842 · Paid Member Subscriptions (WordPress plugin)

    WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability

    Published 22 Oct 2026 · CVE Program
  49. High 8.5

    CVE-2026-112822 · Workreap Core (WordPress plugin)

    WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability

    Published 22 Oct 2026 · Fixed in 3.4.4 · CVE Program
  50. High 8.8

    CVE-2022-51021 · Notificationx (WordPress plugin)

    NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint

    Published 22 Oct 2026 · Fixed in 2.3.12 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.