UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 6.5

    CVE-2026-110880 · Convertkit (WordPress plugin)

    WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability

    Published 18 Oct 2026 · CVE Program
  2. Critical 9.8

    CVE-2026-110886 · Conversational Forms (WordPress plugin)

    WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability

    Published 18 Oct 2026 · CVE Program
  3. High 7.1

    CVE-2026-109895 · Booktics (WordPress plugin)

    WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability

    Published 18 Oct 2026 · CVE Program
  4. Critical 9.3

    CVE-2026-109894 · Booktics (WordPress plugin)

    WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability

    Published 18 Oct 2026 · CVE Program
  5. Medium 6.5

    CVE-2026-110883 · Webcam 2way Videochat (WordPress plugin)

    WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability

    Published 18 Oct 2026 · CVE Program
  6. High 7.5

    CVE-2026-110383 · Signature Fluent Contract Forms Add On (WordPress plugin)

    WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability

    Published 18 Oct 2026 · CVE Program
  7. High 7.1

    CVE-2026-110897 · Powerpack Addon For Beaver Builder (WordPress plugin)

    WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

    Published 18 Oct 2026 · CVE Program
  8. Critical 9.8

    CVE-2026-110372 · Suretriggers (WordPress plugin)

    WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability

    Published 18 Oct 2026 · CVE Program
  9. High 7.1

    CVE-2026-110382 · Simply Schedule Appointments (WordPress plugin)

    WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability

    Published 18 Oct 2026 · CVE Program
  10. High 7.1

    CVE-2026-108485 · Estore (WordPress plugin), Estore (WordPress theme)

    WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability

    Published 18 Oct 2026 · CVE Program
  11. Medium 6.5

    CVE-2026-110885 · Hivepress (WordPress plugin)

    WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerability

    Published 18 Oct 2026 · CVE Program
  12. Medium 6.5

    CVE-2026-110365 · File Manager Advanced (WordPress plugin)

    Vulnerability in Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution

    Published 18 Oct 2026 · Fixed in 6.0.0 · CVE Program, WPVulnerability
  13. Medium 4.3

    CVE-2026-110882 · SMS Alert (WordPress plugin)

    WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability

    Published 17 Oct 2026 · CVE Program
  14. High 7.1

    CVE-2026-109701 · Paytpv For Woocommerce (WordPress plugin)

    WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability

    Published 17 Oct 2026 · CVE Program
  15. High 7.5

    CVE-2026-110889 · Gantry5 (WordPress plugin)

    WordPress Gantry 5 Framework plugin <= 5.6.4 - Sensitive Data Exposure vulnerability

    Published 17 Oct 2026 · CVE Program
  16. Medium 5.4

    CVE-2026-110253 · Weforms (WordPress plugin)

    weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter

    Published 17 Oct 2026 · CVE Program
  17. High 7.2

    CVE-2026-100316 · Woocommerce Eu Vat Compliance (WordPress plugin)

    European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header

    Published 17 Oct 2026 · CVE Program
  18. Medium 6.4

    CVE-2026-109983 · Ymc Smart Filter (WordPress plugin)

    YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter

    Published 17 Oct 2026 · CVE Program
  19. High 7.2

    CVE-2026-111110 · Invoicing (WordPress plugin)

    Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter

    Published 17 Oct 2026 · CVE Program
  20. High 7.1

    CVE-2026-110384 · Fancy Facebook Comments (WordPress plugin)

    WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability

    Published 17 Oct 2026 · CVE Program
  21. High 8.1

    CVE-2026-92798 · User Registration (WordPress plugin)

    User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag

    Published 17 Oct 2026 · CVE Program
  22. High 7.2

    CVE-2026-103899 · Woocommerce Eu Vat Assistant (WordPress plugin)

    EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter

    Published 17 Oct 2026 · CVE Program
  23. Medium 6.4

    CVE-2026-109989 · Themify Popup (WordPress plugin)

    Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter

    Published 17 Oct 2026 · CVE Program
  24. Medium 6.5

    CVE-2026-107744 · Learnpress (WordPress plugin)

    LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action

    Published 17 Oct 2026 · CVE Program
  25. Medium 6.4

    CVE-2026-111726 · Themify Builder (WordPress plugin)

    Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute

    Published 17 Oct 2026 · CVE Program
  26. High 7.5

    CVE-2026-108123 · WP Booking System (WordPress plugin)

    WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action

    Published 17 Oct 2026 · CVE Program
  27. Medium 4.3

    CVE-2026-92978 · User Registration (WordPress plugin)

    User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()

    Published 17 Oct 2026 · CVE Program
  28. Medium 6.8

    CVE-2026-109369 · WP Booking System (WordPress plugin)

    WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse

    Published 17 Oct 2026 · CVE Program
  29. High 7.2

    CVE-2026-96660 · User Registration (WordPress plugin)

    User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value

    Published 17 Oct 2026 · CVE Program
  30. Critical 9.8

    CVE-2026-104736 · Learnpress (WordPress plugin)

    LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter

    Published 17 Oct 2026 · CVE Program
  31. Medium 6.5

    CVE-2026-109368 · WP Booking System (WordPress plugin)

    WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action

    Published 17 Oct 2026 · CVE Program
  32. Medium 4.3

    CVE-2026-92715 · Tutor (WordPress plugin)

    Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter

    Published 17 Oct 2026 · CVE Program
  33. Medium 4.9

    CVE-2026-107752 · Usc E Shop (WordPress plugin)

    Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie

    Published 17 Oct 2026 · CVE Program
  34. Medium 6.4

    CVE-2026-109985 · Xspeed (WordPress plugin)

    xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter

    Published 17 Oct 2026 · CVE Program
  35. Medium 4.9

    CVE-2026-110268 · Post Export Import With Media (WordPress plugin)

    Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter

    Published 17 Oct 2026 · CVE Program
  36. Low 3.7

    CVE-2026-111602 · Latepoint (WordPress plugin)

    Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter

    Published 17 Oct 2026 · CVE Program
  37. Critical 9.1

    CVE-2026-110653 · Latepoint (WordPress plugin)

    Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter

    Published 17 Oct 2026 · CVE Program
  38. High 7.2

    CVE-2026-109208 · Learnpress (WordPress plugin)

    LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters

    Published 17 Oct 2026 · CVE Program
  39. Medium 6.1

    CVE-2026-111601 · Hippoo (WordPress plugin)

    Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter

    Published 17 Oct 2026 · CVE Program
  40. High 7.2

    CVE-2026-104734 · Kirki (WordPress plugin)

    Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import

    Published 17 Oct 2026 · CVE Program
  41. High 7.5

    CVE-2026-107762 · Kirki (WordPress plugin)

    Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter

    Published 17 Oct 2026 · CVE Program
  42. Medium 4.3

    CVE-2026-107763 · Fastcache By Host It (WordPress plugin)

    Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook

    Published 17 Oct 2026 · CVE Program
  43. Medium 6.4

    CVE-2026-97470 · Tourfic (WordPress plugin)

    Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role

    Published 16 Oct 2026 · CVE Program
  44. High 8.8

    CVE-2026-111413 · Athemeart Theme Helper (WordPress plugin)

    WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability

    Published 16 Oct 2026 · CVE Program
  45. Medium 5.3

    CVE-2026-110896 · Content Protector (WordPress plugin)

    WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability

    Published 16 Oct 2026 · CVE Program
  46. Medium 6.5

    CVE-2026-111400 · Powerpack Lite For Elementor (WordPress plugin)

    WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

    Published 16 Oct 2026 · CVE Program
  47. High 7.1

    CVE-2026-111396 · Advanced Post Manager (WordPress plugin)

    WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability

    Published 16 Oct 2026 · CVE Program
  48. Medium 5.3

    CVE-2026-111409 · Yith Paypal Express Checkout For Woocommerce (WordPress plugin)

    WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability

    Published 16 Oct 2026 · CVE Program
  49. Medium 6.5

    CVE-2026-110903 · The Events Calendar (WordPress plugin)

    WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability

    Published 16 Oct 2026 · CVE Program
  50. Medium 5.3

    CVE-2026-110900 · Bookit (WordPress plugin)

    WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability

    Published 16 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.