UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 8.8

    CVE-2026-110369 · Gs Team Members (WordPress plugin)

    WordPress WordPress Team Members – GS Plugins plugin <= 2.8.2 - PHP Object Injection vulnerability

    Published 21 Oct 2026 · CVE Program
  2. High 8.8

    CVE-2026-110370 · Gs Pinterest Portfolio (WordPress plugin)

    WordPress GS Pins for Pinterest plugin <= 1.9.2 - PHP Object Injection vulnerability

    Published 21 Oct 2026 · CVE Program
  3. High 7.1

    CVE-2026-110884 · Live Summary For Gravity Forms (WordPress plugin)

    WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

    Published 21 Oct 2026 · CVE Program
  4. High 7.1

    CVE-2026-110899 · Ninja Forms (WordPress plugin)

    WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability

    Published 21 Oct 2026 · CVE Program
  5. High 7.1

    CVE-2026-107435 · Strong Testimonials (WordPress plugin)

    WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability

    Published 21 Oct 2026 · CVE Program
  6. High 8.8

    CVE-2026-82814 · Duplicator (WordPress plugin)

    Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection

    Published 21 Oct 2026 · CVE Program
  7. Critical 9.2

    CVE-2016-20101 · Issuu Panel (WordPress plugin)

    Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php

    Published 20 Oct 2026 · Fixed in 1.6.6 · CVE Program
  8. High 8.7

    CVE-2016-20100 · Memphis Documents Library (WordPress plugin)

    Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview

    Published 20 Oct 2026 · Fixed in 3.1.6 · CVE Program
  9. High 8.7

    CVE-2015-20125 · Aspose PDF Exporter (WordPress plugin)

    Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php

    Published 20 Oct 2026 · Fixed in 2.0 · CVE Program
  10. High 8.7

    CVE-2015-20124 · Aspose Importer Exporter (WordPress plugin)

    Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php

    Published 20 Oct 2026 · Fixed in 3.0 · CVE Program
  11. High 8.7

    CVE-2015-20123 · Aspose Doc Exporter (WordPress plugin)

    Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php

    Published 20 Oct 2026 · Fixed in 2.0 · CVE Program
  12. Medium 5.1

    CVE-2014-125132 · Blogroll Fun (WordPress plugin)

    Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php

    Published 20 Oct 2026 · Fixed in 0.8.5 · CVE Program
  13. Medium 5.1

    CVE-2012-20005 · Socialfit (WordPress plugin)

    SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter

    Published 20 Oct 2026 · CVE Program
  14. Medium 5.1

    CVE-2012-20004 · Knews (WordPress plugin)

    K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter

    Published 20 Oct 2026 · Fixed in 1.1.1 · CVE Program
  15. Medium 5.1

    CVE-2012-20003 · Custom Tables (WordPress plugin)

    Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php

    Published 20 Oct 2026 · Fixed in 3.4.6 · CVE Program
  16. High 8.7

    CVE-2012-20002 · Tinymce Thumbnail Gallery (WordPress plugin)

    TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php

    Published 20 Oct 2026 · Fixed in 1.1.0 · CVE Program
  17. Medium 6.3

    CVE-2026-112861 · Participants Database (WordPress plugin)

    WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability

    Published 20 Oct 2026 · CVE Program
  18. Medium 4.3

    CVE-2026-112823 · WP User Manager (WordPress plugin)

    WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability

    Published 20 Oct 2026 · CVE Program
  19. Medium 5.3

    CVE-2026-112824 · Bus Ticket Booking With Seat Reservation (WordPress plugin)

    WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability

    Published 20 Oct 2026 · CVE Program
  20. Medium 6.5

    CVE-2026-111843 · Rootblox (WordPress plugin)

    WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

    Published 20 Oct 2026 · CVE Program
  21. Medium 5.3

    CVE-2026-112829 · Booktics (WordPress plugin)

    WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability

    Published 20 Oct 2026 · CVE Program
  22. Medium 6.5

    CVE-2026-112840 · Surecart (WordPress plugin)

    WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability

    Published 20 Oct 2026 · CVE Program
  23. High 8.8

    CVE-2026-112836 · Vikrentcar (WordPress plugin)

    WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability

    Published 20 Oct 2026 · CVE Program
  24. Medium 6.5

    CVE-2026-109700 · Meta Box (WordPress plugin)

    WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability

    Published 20 Oct 2026 · CVE Program
  25. Medium 5.3

    CVE-2026-112834 · Seriously Simple Podcasting (WordPress plugin)

    WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerability

    Published 20 Oct 2026 · CVE Program
  26. Medium 6.5

    CVE-2026-112833 · Seriously Simple Podcasting (WordPress plugin)

    WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability

    Published 20 Oct 2026 · CVE Program
  27. Medium 5.3

    CVE-2026-113353 · Learnpress (WordPress plugin)

    LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers

    Published 20 Oct 2026 · Fixed in 4.4.10 · CVE Program
  28. Medium 6.5

    CVE-2026-111844 · Brizy (WordPress plugin)

    WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability

    Published 20 Oct 2026 · CVE Program
  29. Medium 4.3

    CVE-2026-111828 · Classified Listing (WordPress plugin)

    WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability

    Published 19 Oct 2026 · CVE Program
  30. Medium 5.4

    CVE-2026-112222 · Surferseo (WordPress plugin)

    WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability

    Published 19 Oct 2026 · CVE Program
  31. Medium 6.5

    CVE-2026-111829 · WP Mailster (WordPress plugin)

    WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability

    Published 19 Oct 2026 · CVE Program
  32. Medium 4.3

    CVE-2026-110902 · Event Tickets (WordPress plugin)

    WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability

    Published 19 Oct 2026 · CVE Program
  33. Medium 5.3

    CVE-2026-111845 · Yith Woocommerce Product Bundles (WordPress plugin)

    WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability

    Published 19 Oct 2026 · CVE Program
  34. Medium 5.3

    CVE-2026-111831 · Fluentform (WordPress plugin)

    WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability

    Published 19 Oct 2026 · CVE Program
  35. Medium 5.4

    CVE-2026-110363 · Learnpress (WordPress plugin)

    WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

    Published 19 Oct 2026 · CVE Program
  36. Medium 4.3

    CVE-2026-111836 · Fluent Community (WordPress plugin)

    WordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability

    Published 19 Oct 2026 · CVE Program
  37. Medium 6.5

    CVE-2026-111414 · Jet Elements (WordPress plugin)

    WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability

    Published 19 Oct 2026 · CVE Program
  38. Medium 6.5

    CVE-2026-111410 · E2pdf (WordPress plugin)

    WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability

    Published 19 Oct 2026 · CVE Program
  39. Medium 5.3

    CVE-2026-111839 · Videowhisper Live Streaming Integration (WordPress plugin)

    WordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerability

    Published 19 Oct 2026 · CVE Program
  40. Critical 9.9

    CVE-2026-110887 · Hivepress (WordPress plugin)

    WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability

    Published 19 Oct 2026 · CVE Program
  41. High 7.7

    CVE-2026-111398 · Mapsvg Lite Interactive Vector Maps (WordPress plugin)

    WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Deletion vulnerability

    Published 19 Oct 2026 · CVE Program
  42. Medium 6.4

    CVE-2026-110898 · Essential Addons For Elementor Lite (WordPress plugin)

    WordPress Essential Addons for Elementor plugin <= 6.8.5 - Privilege Escalation vulnerability

    Published 19 Oct 2026 · CVE Program
  43. Medium 6.5

    CVE-2026-111407 · Tutor (WordPress plugin)

    WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

    Published 19 Oct 2026 · CVE Program
  44. High 8.8

    CVE-2026-111408 · Quiz Master Next (WordPress plugin)

    WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

    Published 19 Oct 2026 · CVE Program
  45. High 7.1

    CVE-2026-110379 · Quiz Maker (WordPress plugin)

    WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability

    Published 19 Oct 2026 · CVE Program
  46. Critical 9.9

    CVE-2026-111406 · Mapsvg Lite Interactive Vector Maps (WordPress plugin)

    WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability

    Published 19 Oct 2026 · CVE Program
  47. Medium 5.1

    CVE-2026-112111 · Bootstrap Shortcodes (WordPress plugin)

    The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following…

    Published 18 Oct 2026 · Fixed in 3.4.6 · CVE Program
  48. High 8.5

    CVE-2026-110895 · Support Genix Lite (WordPress plugin)

    WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerability

    Published 18 Oct 2026 · CVE Program
  49. High 8.8

    CVE-2026-107436 · Strong Testimonials (WordPress plugin)

    WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability

    Published 18 Oct 2026 · CVE Program
  50. High 8.1

    CVE-2026-110373 · Login With Phone Number (WordPress plugin)

    WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerability

    Published 18 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.