UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 8.1

    CVE-2026-109447 · Profile Builder (WordPress plugin)

    User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]

    Published 16 Oct 2026 · CVE Program
  2. High 7.5

    CVE-2026-103896 · Tenweb Speed Optimizer (WordPress plugin)

    10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path

    Published 16 Oct 2026 · CVE Program
  3. High 7.2

    CVE-2026-109232 · Salon Booking System (WordPress plugin)

    Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX

    Published 16 Oct 2026 · CVE Program
  4. Medium 5.4

    CVE-2026-104001 · Slim SEO (WordPress plugin)

    Slim SEO <= 4.11.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'Biographical Info' User Meta

    Published 16 Oct 2026 · CVE Program
  5. High 7.2

    CVE-2026-95809 · Opti Behavior (WordPress plugin)

    Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter

    Published 16 Oct 2026 · CVE Program
  6. Medium 5.3

    CVE-2026-12272 · Lightweight Cookie Notice Free (WordPress plugin)

    Lightweight Cookie Notice <= 1.19 - Sensitive Information Exposure via W3TC_DYNAMIC_SECURITY Constant

    Published 16 Oct 2026 · CVE Program
  7. Critical 9.8

    CVE-2026-89079 · Theme My Login (WordPress plugin)

    Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter

    Published 16 Oct 2026 · CVE Program
  8. Medium 6.5

    CVE-2026-93767 · Tainacan (WordPress plugin)

    Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter

    Published 16 Oct 2026 · CVE Program
  9. High 7.2

    CVE-2026-95686 · Opti Behavior (WordPress plugin)

    Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter

    Published 16 Oct 2026 · CVE Program
  10. High 7.2

    CVE-2026-104000 · Simply Schedule Appointments (WordPress plugin)

    Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}

    Published 16 Oct 2026 · CVE Program
  11. Medium 6.4

    CVE-2026-103480 · Tourfic (WordPress plugin)

    Tourfic <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute

    Published 16 Oct 2026 · CVE Program
  12. Medium 6.4

    CVE-2026-107748 · Profile Builder (WordPress plugin)

    User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter

    Published 16 Oct 2026 · CVE Program
  13. High 7.2

    CVE-2026-103999 · Ultimate Addons For Contact Form 7 (WordPress plugin)

    Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload

    Published 16 Oct 2026 · CVE Program
  14. Medium 6.4

    CVE-2026-110017 · Quick Paypal Payments (WordPress plugin)

    Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute

    Published 16 Oct 2026 · CVE Program
  15. Medium 6.4

    CVE-2026-100158 · Sql Chart Builder (WordPress plugin)

    SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field

    Published 16 Oct 2026 · CVE Program
  16. High 7.2

    CVE-2026-96570 · Schema And Structured Data For WP (WordPress plugin)

    Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter

    Published 16 Oct 2026 · CVE Program
  17. High 8.1

    CVE-2026-109221 · Groundhogg (WordPress plugin)

    Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping

    Published 16 Oct 2026 · CVE Program
  18. High 7.5

    CVE-2026-107659 · Modula Best Grid Gallery (WordPress plugin)

    Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT

    Published 16 Oct 2026 · CVE Program
  19. Critical 9.8

    CVE-2026-104798 · My Calendar (WordPress plugin)

    My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute

    Published 16 Oct 2026 · CVE Program
  20. Medium 6.1

    CVE-2026-103481 · Gwolle Gb (WordPress plugin)

    Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter

    Published 16 Oct 2026 · CVE Program
  21. Medium 4.3

    CVE-2026-110019 · Lpagery (WordPress plugin)

    Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow

    Published 16 Oct 2026 · CVE Program
  22. High 7.5

    CVE-2026-110590 · Klarna Payments For Woocommerce (WordPress plugin)

    Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint

    Published 16 Oct 2026 · CVE Program
  23. High 7.5

    CVE-2026-107746 · Funnel Builder (WordPress plugin)

    FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter

    Published 16 Oct 2026 · CVE Program
  24. High 7.5

    CVE-2026-111114 · Nexter Extension (WordPress plugin)

    Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter

    Published 16 Oct 2026 · CVE Program
  25. High 7.2

    CVE-2026-109998 · Mangboard (WordPress plugin)

    Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX

    Published 16 Oct 2026 · CVE Program
  26. Medium 6.5

    CVE-2026-103911 · Forminator (WordPress plugin)

    Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block

    Published 16 Oct 2026 · CVE Program
  27. Medium 4.3

    CVE-2026-109191 · Image Hub (WordPress plugin)

    Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML

    Published 16 Oct 2026 · CVE Program
  28. Critical 9.8

    CVE-2026-109515 · Mailoptin (WordPress plugin)

    MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter

    Published 16 Oct 2026 · CVE Program
  29. High 7.5

    CVE-2026-109400 · Instawp Connect (WordPress plugin)

    InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_roles' Role-as-Capability Setting

    Published 16 Oct 2026 · CVE Program
  30. Medium 5.3

    CVE-2026-110721 · Notificationx (WordPress plugin)

    NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route

    Published 16 Oct 2026 · CVE Program
  31. High 7.5

    CVE-2026-103525 · Fluent Cart (WordPress plugin)

    FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters

    Published 16 Oct 2026 · CVE Program
  32. Medium 6.5

    CVE-2026-111106 · Mail Mint (WordPress plugin)

    Mail Mint <= 1.31.4 - Authenticated (Custom+) SQL Injection via 'filters' Parameter

    Published 16 Oct 2026 · CVE Program
  33. Medium 6.4

    CVE-2026-109512 · Mangboard (WordPress plugin)

    Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter

    Published 16 Oct 2026 · CVE Program
  34. High 8.1

    CVE-2026-103895 · Miniorange Otp Verification (WordPress plugin)

    miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State

    Published 16 Oct 2026 · CVE Program
  35. Medium 6.5

    CVE-2026-101335 · Forminator (WordPress plugin)

    Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags

    Published 16 Oct 2026 · CVE Program
  36. Critical 9.8

    CVE-2026-109219 · Mangboard (WordPress plugin)

    Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter

    Published 16 Oct 2026 · CVE Program
  37. Medium 6.5

    CVE-2026-96562 · Broken Link Checker (WordPress plugin)

    Broken Link Checker <= 2.4.14.1 - Unauthenticated Arbitrary Shortcode Execution via parser_callback

    Published 16 Oct 2026 · CVE Program
  38. Medium 4.3

    CVE-2026-89280 · Dokan Lite (WordPress plugin)

    Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}

    Published 16 Oct 2026 · CVE Program
  39. High 7.2

    CVE-2026-107758 · Colibri Page Builder (WordPress plugin)

    Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments

    Published 16 Oct 2026 · CVE Program
  40. High 7.2

    CVE-2026-109207 · Feedzy Rss Feeds (WordPress plugin)

    RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL

    Published 16 Oct 2026 · CVE Program
  41. Medium 5.9

    CVE-2026-104769 · Debloat (WordPress plugin)

    Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>

    Published 16 Oct 2026 · CVE Program
  42. High 8.1

    CVE-2026-104745 · Emails Verification For Woocommerce (WordPress plugin)

    Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter

    Published 16 Oct 2026 · CVE Program
  43. High 7.2

    CVE-2026-97339 · Complianz Gdpr (WordPress plugin)

    Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter

    Published 16 Oct 2026 · CVE Program
  44. High 8.0

    CVE-2026-93953 · Backuply (WordPress plugin)

    Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation

    Published 16 Oct 2026 · CVE Program
  45. High 7.2

    CVE-2026-109990 · Flying Scripts (WordPress plugin)

    Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    Published 16 Oct 2026 · CVE Program
  46. Medium 4.9

    CVE-2026-103518 · Fluent Cart (WordPress plugin)

    FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys

    Published 16 Oct 2026 · CVE Program
  47. Medium 6.4

    CVE-2026-77829 · Cooked (WordPress plugin)

    Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content

    Published 16 Oct 2026 · CVE Program
  48. Medium 4.8

    CVE-2026-100159 · Ays Popup Box (WordPress plugin)

    Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers

    Published 16 Oct 2026 · CVE Program
  49. Medium 6.5

    CVE-2026-110361 · Infinite Uploads (WordPress plugin)

    WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerability

    Published 15 Oct 2026 · CVE Program
  50. Medium 5.3

    CVE-2026-110362 · Planetstudio Payment Gateway (WordPress plugin)

    WordPress PlanetStudio Payment Gateway plugin <= 1.3.3 - Broken Access Control vulnerability

    Published 15 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.