UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 7.7

    CVE-2017-20289 · Ad Widget (WordPress plugin)

    Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter

    Published 22 Oct 2026 · Fixed in 2.12.0 · CVE Program
  2. High 7.1

    CVE-2026-112313 · Acf Extended (WordPress plugin)

    WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability

    Published 22 Oct 2026 · CVE Program
  3. High 8.1

    CVE-2026-112820 · Academist Core (WordPress plugin)

    WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability

    Published 22 Oct 2026 · CVE Program
  4. Medium 6.5

    CVE-2026-114703 · Extensions Leaflet Map (WordPress plugin)

    WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability

    Published 22 Oct 2026 · CVE Program
  5. Medium 6.5

    CVE-2026-114702 · Nd Shortcodes (WordPress plugin)

    WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability

    Published 22 Oct 2026 · CVE Program
  6. Medium 6.5

    CVE-2026-114701 · Waitlist Woocommerce (WordPress plugin)

    WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability

    Published 22 Oct 2026 · CVE Program
  7. Medium 6.5

    CVE-2026-114700 · Menu Ordering Reservations (WordPress plugin)

    WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability

    Published 22 Oct 2026 · CVE Program
  8. Medium 5.3

    CVE-2026-114699 · Yookassa (WordPress plugin)

    WordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerability

    Published 22 Oct 2026 · CVE Program
  9. Medium 5.3

    CVE-2026-114195 · Shopmagic For Woocommerce (WordPress plugin)

    WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability

    Published 22 Oct 2026 · CVE Program
  10. Medium 5.3

    CVE-2026-112218 · Majestic Support (WordPress plugin)

    WordPress Majestic Support plugin <= 1.2.1 - Broken Access Control vulnerability

    Published 22 Oct 2026 · CVE Program
  11. Medium 5.3

    CVE-2026-114696 · Page And Post Restriction (WordPress plugin)

    WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability

    Published 22 Oct 2026 · CVE Program
  12. Medium 5.3

    CVE-2026-111842 · Sunshine Photo Cart (WordPress plugin)

    WordPress Sunshine Photo Cart plugin <= 3.7.5 - Broken Access Control vulnerability

    Published 22 Oct 2026 · CVE Program
  13. Medium 6.5

    CVE-2026-112311 · Acf Extended (WordPress plugin)

    WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability

    Published 22 Oct 2026 · CVE Program
  14. High 7.6

    CVE-2026-111851 · Royal Elementor Addons (WordPress plugin)

    WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability

    Published 22 Oct 2026 · CVE Program
  15. High 7.5

    CVE-2026-112312 · Acf Extended (WordPress plugin)

    WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability

    Published 22 Oct 2026 · CVE Program
  16. High 7.1

    CVE-2026-111830 · WP Mailster (WordPress plugin)

    WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability

    Published 22 Oct 2026 · CVE Program
  17. Critical 9.8

    CVE-2026-112241 · Surecart (WordPress plugin)

    WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability

    Published 22 Oct 2026 · CVE Program
  18. High 8.8

    CVE-2026-112242 · Profile Builder (WordPress plugin)

    WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability

    Published 22 Oct 2026 · CVE Program
  19. Medium 6.5

    CVE-2026-112845 · Off Canvas Sidebars (WordPress plugin)

    WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability

    Published 22 Oct 2026 · CVE Program
  20. Medium 5.3

    CVE-2026-110893 · Suredash (WordPress plugin)

    WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

    Published 22 Oct 2026 · CVE Program
  21. Medium 5.3

    CVE-2026-110894 · Suredash (WordPress plugin)

    WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

    Published 22 Oct 2026 · CVE Program
  22. Medium 5.4

    CVE-2026-114698 · Mycred (WordPress plugin)

    WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerability

    Published 22 Oct 2026 · CVE Program
  23. Critical 9.3

    CVE-2026-112327 · Ameliabooking (WordPress plugin)

    WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability

    Published 22 Oct 2026 · CVE Program
  24. High 7.1

    CVE-2026-112379 · Contact Form To Email (WordPress plugin)

    WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability

    Published 22 Oct 2026 · CVE Program
  25. Medium 4.3

    CVE-2026-114182 · Powerpack Lite For Elementor (WordPress plugin)

    WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Broken Access Control vulnerability

    Published 22 Oct 2026 · CVE Program
  26. Medium 4.3

    CVE-2026-112843 · Strong Testimonials (WordPress plugin)

    WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability

    Published 22 Oct 2026 · CVE Program
  27. Medium 5.3

    CVE-2026-112826 · Falcon (WordPress plugin)

    WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerability

    Published 22 Oct 2026 · CVE Program
  28. Medium 5.3

    CVE-2026-114180 · Metform (WordPress plugin)

    WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerability

    Published 22 Oct 2026 · CVE Program
  29. Medium 5.4

    CVE-2026-111847 · Marketking Multivendor Marketplace For Woocommerce (WordPress plugin)

    WordPress MarketKing plugin <= 2.1.72 - Broken Access Control vulnerability

    Published 22 Oct 2026 · CVE Program
  30. High 8.8

    CVE-2026-114177 · Xpro Elementor Addons (WordPress plugin)

    WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability

    Published 22 Oct 2026 · CVE Program
  31. Medium 5.4

    CVE-2026-114175 · Eroom Zoom Meetings Webinar (WordPress plugin)

    WordPress eRoom plugin <= 1.7.1 - Settings Change vulnerability

    Published 22 Oct 2026 · CVE Program
  32. Medium 6.5

    CVE-2026-112867 · H5p (WordPress plugin)

    WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability

    Published 22 Oct 2026 · CVE Program
  33. Medium 6.5

    CVE-2026-114184 · Addon Elements For Elementor Page Builder (WordPress plugin)

    WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability

    Published 22 Oct 2026 · CVE Program
  34. Medium 4.9

    CVE-2026-114570 · WordPress

    WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit

    Published 22 Oct 2026 · CVE Program
  35. Unrated

    CVE-2026-109987 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Cross-site Scripting

    Published 22 Oct 2026 · Fixed in 11.4.3 · WPVulnerability
  36. Medium 6.5

    CVE-2026-111401 · Tailored Tools (WordPress plugin)

    WordPress Tailored Tools plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerability

    Published 21 Oct 2026 · CVE Program
  37. Medium 4.3

    CVE-2026-112868 · H5p (WordPress plugin)

    WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability

    Published 21 Oct 2026 · CVE Program
  38. Medium 4.3

    CVE-2026-114176 · Eroom Zoom Meetings Webinar (WordPress plugin)

    WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability

    Published 21 Oct 2026 · CVE Program
  39. Critical 10.0

    CVE-2026-111832 · WP Mailster (WordPress plugin)

    WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability

    Published 21 Oct 2026 · CVE Program
  40. Critical 9.9

    CVE-2026-111834 · Mangboard (WordPress plugin)

    WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability

    Published 21 Oct 2026 · CVE Program
  41. Medium 6.5

    CVE-2026-111835 · Woo Swish E Commerce (WordPress plugin)

    WordPress BjornTech Swish for WooCommerce plugin <= 3.7.8 - Broken Access Control vulnerability

    Published 21 Oct 2026 · CVE Program
  42. High 7.1

    CVE-2026-111848 · Geo Mashup (WordPress plugin)

    WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability

    Published 21 Oct 2026 · CVE Program
  43. High 7.1

    CVE-2026-112221 · Surecart (WordPress plugin)

    WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability

    Published 21 Oct 2026 · CVE Program
  44. High 7.5

    CVE-2026-111833 · Weforms (WordPress plugin)

    WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability

    Published 21 Oct 2026 · CVE Program
  45. Medium 6.5

    CVE-2026-111837 · Contest Gallery (WordPress plugin)

    WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerability

    Published 21 Oct 2026 · CVE Program
  46. High 7.1

    CVE-2026-111838 · Themehunk Customizer (WordPress plugin)

    WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability

    Published 21 Oct 2026 · CVE Program
  47. High 7.1

    CVE-2026-111840 · Ppv Live Webcams (WordPress plugin)

    WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerability

    Published 21 Oct 2026 · CVE Program
  48. Critical 9.3

    CVE-2026-111852 · Ajax Search Lite (WordPress plugin)

    WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability

    Published 21 Oct 2026 · CVE Program
  49. Medium 5.3

    CVE-2026-111849 · Tour Booking Manager (WordPress plugin)

    WordPress WpTravelly plugin <= 2.3.5 - Broken Access Control vulnerability

    Published 21 Oct 2026 · CVE Program
  50. Medium 5.3

    CVE-2026-114120 · WP Scheduled Posts (WordPress plugin)

    SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action

    Published 21 Oct 2026 · Fixed in 5.3.5 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.