UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Low 2.7

    CVE-2026-97194 · Secure Custom Fields (WordPress plugin)

    Secure Custom Fields: Exposure of Sensitive Information to an Unauthorized Actor

    Published 8 Nov 2026 · Fixed in 6.9.8 · WPVulnerability
  2. Low 2.7

    CVE-2026-97193 · Secure Custom Fields (WordPress plugin)

    Secure Custom Fields: Authorization Bypass Through User-Controlled Key

    Published 8 Nov 2026 · Fixed in 6.9.8 · WPVulnerability
  3. Low 2.7

    CVE-2026-97192 · Secure Custom Fields (WordPress plugin)

    Secure Custom Fields: Improper Access Control

    Published 8 Nov 2026 · Fixed in 6.9.8 · WPVulnerability
  4. Medium 6.5

    CVE-2026-123472 · Meta Box (WordPress plugin)

    WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  5. Medium 5.3

    CVE-2026-119522 · User Registration (WordPress plugin)

    WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  6. Medium 5.3

    CVE-2026-123461 · Woocommerce Currency Switcher (WordPress plugin)

    WordPress FOX plugin <= 1.5.6 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  7. Medium 6.5

    CVE-2026-120836 · Meta Box (WordPress plugin)

    WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  8. Medium 5.3

    CVE-2026-124258 · User Registration (WordPress plugin)

    WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  9. Medium 5.3

    CVE-2026-123860 · Jetformbuilder (WordPress plugin)

    WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

    Published 7 Nov 2026 · CVE Program
  10. Medium 5.3

    CVE-2026-123861 · Jet Form Builder Hierarchical Select (WordPress plugin)

    WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability

    Published 7 Nov 2026 · CVE Program
  11. High 8.8

    CVE-2026-120839 · Tour Booking Manager (WordPress plugin)

    WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

    Published 7 Nov 2026 · CVE Program
  12. High 8.8

    CVE-2026-120841 · Tour Booking Manager (WordPress plugin)

    WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

    Published 7 Nov 2026 · CVE Program
  13. Medium 5.3

    CVE-2026-121777 · Extensions For Elementor Form (WordPress plugin)

    WordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerability

    Published 7 Nov 2026 · CVE Program
  14. Medium 4.3

    CVE-2026-123467 · Motors Car Dealership Classified Listings (WordPress plugin)

    WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  15. Medium 5.4

    CVE-2026-122659 · Fluent Booking (WordPress plugin)

    WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  16. Medium 6.5

    CVE-2026-121579 · Unlimited Elements For Elementor (WordPress plugin)

    WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  17. Medium 5.3

    CVE-2026-121575 · WP User Manager (WordPress plugin)

    WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  18. Medium 4.3

    CVE-2026-122660 · Bakkbone Florist Companion (WordPress plugin)

    WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  19. Medium 5.3

    CVE-2026-123483 · Jetformbuilder (WordPress plugin)

    WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

    Published 7 Nov 2026 · CVE Program
  20. Medium 5.3

    CVE-2026-123183 · Profit Products Tables For Woocommerce (WordPress plugin)

    WordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerability

    Published 7 Nov 2026 · CVE Program
  21. Medium 5.3

    CVE-2026-123474 · Premium Blocks For Gutenberg (WordPress plugin)

    WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  22. Medium 5.3

    CVE-2026-121775 · Woo Multi Currency (WordPress plugin)

    WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  23. Medium 5.3

    CVE-2026-123462 · Mycred (WordPress plugin)

    WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  24. Medium 6.5

    CVE-2026-122669 · Everest Forms (WordPress plugin)

    WordPress Everest Forms plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  25. Medium 5.3

    CVE-2026-122663 · Woo Multi Currency (WordPress plugin)

    WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  26. Medium 6.5

    CVE-2026-121784 · Service Booking Manager (WordPress plugin)

    WordPress WpBookingly plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  27. Medium 6.5

    CVE-2026-123477 · Jet Engine (WordPress plugin)

    WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  28. Medium 6.4

    CVE-2026-120579 · Profit Products Tables For Woocommerce (WordPress plugin)

    Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'help_title' Shortcode Attribute

    Published 7 Nov 2026 · CVE Program
  29. Medium 6.4

    CVE-2026-109973 · Image Hover Effects Ultimate Visual Composer (WordPress plugin)

    Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter

    Published 7 Nov 2026 · CVE Program
  30. High 7.2

    CVE-2026-119156 · Download Manager (WordPress plugin)

    Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]

    Published 7 Nov 2026 · CVE Program
  31. Medium 5.3

    CVE-2026-119498 · Simple Cloudflare Turnstile (WordPress plugin)

    WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerability

    Published 7 Nov 2026 · CVE Program
  32. High 7.2

    CVE-2026-93429 · Vikbooking (WordPress plugin)

    VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter

    Published 7 Nov 2026 · CVE Program
  33. Medium 5.4

    CVE-2026-121977 · Jetformbuilder (WordPress plugin)

    JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property

    Published 7 Nov 2026 · CVE Program
  34. Medium 4.7

    CVE-2026-120509 · Testimonial Free (WordPress plugin)

    Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter

    Published 7 Nov 2026 · CVE Program
  35. High 7.2

    CVE-2026-115548 · Quttera Web Malware Scanner (WordPress plugin)

    Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

    Published 7 Nov 2026 · CVE Program
  36. High 7.2

    CVE-2026-111317 · Jetformbuilder (WordPress plugin)

    JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source

    Published 7 Nov 2026 · CVE Program
  37. High 7.2

    CVE-2026-109214 · WP User Frontend (WordPress plugin)

    User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input

    Published 7 Nov 2026 · CVE Program
  38. High 7.2

    CVE-2026-111370 · WP Stats Manager (WordPress plugin)

    WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker Parameters

    Published 7 Nov 2026 · CVE Program
  39. High 7.5

    CVE-2026-109991 · Funnelkit Stripe Woo Payment Gateway (WordPress plugin)

    FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameter

    Published 7 Nov 2026 · CVE Program
  40. Critical 9.8

    CVE-2026-104014 · Naimur Email Otp For Woocommerce (WordPress plugin)

    Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization

    Published 7 Nov 2026 · CVE Program
  41. Medium 6.4

    CVE-2026-118050 · Football Pool (WordPress plugin)

    Football Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message

    Published 7 Nov 2026 · CVE Program
  42. High 8.1

    CVE-2026-118267 · WP Data Access (WordPress plugin)

    WP Data Access <= 5.5.89 - Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert

    Published 7 Nov 2026 · CVE Program
  43. High 7.2

    CVE-2026-123418 · Church Admin (WordPress plugin)

    Church Admin <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'lat' Parameter

    Published 7 Nov 2026 · CVE Program
  44. Medium 6.4

    CVE-2026-121976 · Modula Best Grid Gallery (WordPress plugin)

    Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter

    Published 7 Nov 2026 · CVE Program
  45. High 7.2

    CVE-2026-122231 · Ws Form (WordPress plugin)

    WS Form LITE <= 1.12.18 - Unauthenticated Stored Cross-Site Scripting via Text Field Array Value

    Published 7 Nov 2026 · CVE Program
  46. Medium 5.4

    CVE-2026-120685 · Testimonial Free (WordPress plugin)

    Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via JPEG IPTC Caption + '[gallery]' Shortcode Chain

    Published 7 Nov 2026 · CVE Program
  47. High 7.2

    CVE-2026-109230 · WP Stats Manager (WordPress plugin)

    WP Visitor Statistics (Real Time Traffic) <= 8.7.1 - Unauthenticated Stored Cross-Site Scripting via 'browser' Parameter

    Published 7 Nov 2026 · CVE Program
  48. High 7.2

    CVE-2026-93766 · Happyforms Upgrade (WordPress plugin)

    Happyforms Pro <= 1.38.9 - Unauthenticated Stored Cross-Site Scripting via 'happyforms_client_referer' Parameter

    Published 7 Nov 2026 · CVE Program
  49. Critical 9.8

    CVE-2026-119075 · Registration Form For Woocommerce (WordPress plugin)

    Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout

    Published 7 Nov 2026 · CVE Program
  50. High 8.1

    CVE-2026-104746 · Motors Car Dealership Classified Listings (WordPress plugin)

    Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta

    Published 7 Nov 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.