UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 6.5

    CVE-2026-109893 · Presto Player (WordPress plugin)

    WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability

    Published 15 Oct 2026 · CVE Program
  2. Medium 4.3

    CVE-2026-110374 · Login With Phone Number (WordPress plugin)

    WordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vulnerability

    Published 15 Oct 2026 · CVE Program
  3. Medium 5.3

    CVE-2026-108499 · Knowledgebase (WordPress plugin)

    WordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability

    Published 15 Oct 2026 · CVE Program
  4. Medium 5.3

    CVE-2026-110364 · Flexible Quantity Measurement Price Calculator For Woocommerce (WordPress plugin)

    WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.23 - Broken Access Control vulnerability

    Published 15 Oct 2026 · CVE Program
  5. Medium 6.5

    CVE-2026-110375 · Download Monitor (WordPress plugin)

    WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

    Published 15 Oct 2026 · CVE Program
  6. Medium 5.3

    CVE-2026-109689 · Sunshine Photo Cart (WordPress plugin)

    WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability

    Published 15 Oct 2026 · CVE Program
  7. Medium 5.3

    CVE-2026-110360 · Ajax Search Lite (WordPress plugin)

    WordPress Ajax Search Lite plugin <= 4.14.5 - Broken Access Control vulnerability

    Published 15 Oct 2026 · CVE Program
  8. Medium 5.4

    CVE-2026-109897 · Strong Testimonials (WordPress plugin)

    WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability

    Published 15 Oct 2026 · CVE Program
  9. Medium 5.3

    CVE-2026-110378 · Ninja Signature Contract Forms Add On (WordPress plugin)

    WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability

    Published 15 Oct 2026 · CVE Program
  10. Medium 5.3

    CVE-2026-96449 · WP Easy Pay (WordPress plugin)

    WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability

    Published 15 Oct 2026 · CVE Program
  11. Medium 6.5

    CVE-2026-106604 · Yith Woocommerce Compare (WordPress plugin)

    WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

    Published 15 Oct 2026 · CVE Program
  12. Medium 5.4

    CVE-2026-103083 · Elex Bulk Edit Products Prices Attributes For Woocommerce Basic (WordPress plugin)

    WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability

    Published 15 Oct 2026 · CVE Program
  13. Medium 6.5

    CVE-2026-108175 · WP Meta Data Filter And Taxonomy Filter (WordPress plugin)

    WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability

    Published 15 Oct 2026 · CVE Program
  14. Medium 6.3

    CVE-2026-110381 · Simply Schedule Appointments (WordPress plugin)

    WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability

    Published 15 Oct 2026 · CVE Program
  15. Medium 5.3

    CVE-2026-103350 · Booking And Rental Manager For Woocommerce (WordPress plugin)

    WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerability

    Published 15 Oct 2026 · CVE Program
  16. Medium 4.3

    CVE-2026-110888 · AI Engine (WordPress plugin)

    WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability

    Published 15 Oct 2026 · CVE Program
  17. Medium 5.4

    CVE-2026-110891 · Wordlift (WordPress plugin)

    WordPress WordLift plugin <= 3.54.15 - Broken Access Control vulnerability

    Published 15 Oct 2026 · CVE Program
  18. Medium 6.5

    CVE-2026-110890 · Jet Smart Filters (WordPress plugin)

    WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability

    Published 15 Oct 2026 · CVE Program
  19. Medium 5.3

    CVE-2026-110367 · Woosquare (WordPress plugin)

    WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability

    Published 15 Oct 2026 · CVE Program
  20. Medium 4.3

    CVE-2026-110371 · Strong Testimonials (WordPress plugin)

    WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability

    Published 15 Oct 2026 · CVE Program
  21. High 7.1

    CVE-2026-105065 · Xstore (WordPress theme)

    WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability

    Published 15 Oct 2026 · Fixed in 9.7.9 · CVE Program
  22. Critical 9.8

    CVE-2026-109686 · Link Whisper (WordPress plugin)

    WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability

    Published 15 Oct 2026 · CVE Program
  23. High 7.1

    CVE-2026-109685 · Link Whisper (WordPress plugin)

    WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability

    Published 15 Oct 2026 · CVE Program
  24. Critical 9.8

    CVE-2026-109892 · Acf Frontend Form Element (WordPress plugin)

    WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability

    Published 15 Oct 2026 · CVE Program
  25. Medium 6.5

    CVE-2026-102389 · Broken Link Checker (WordPress plugin)

    WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability

    Published 15 Oct 2026 · CVE Program
  26. Medium 6.5

    CVE-2026-105882 · User Registration (WordPress plugin)

    WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

    Published 15 Oct 2026 · CVE Program
  27. Critical 9.3

    CVE-2026-109688 · Link Whisper (WordPress plugin)

    WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability

    Published 15 Oct 2026 · CVE Program
  28. High 7.5

    CVE-2026-107416 · Webba Booking Lite (WordPress plugin)

    WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability

    Published 15 Oct 2026 · CVE Program
  29. High 7.1

    CVE-2026-109702 · Share Button (WordPress plugin)

    WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability

    Published 15 Oct 2026 · CVE Program
  30. Critical 9.3

    CVE-2026-109698 · Mangboard (WordPress plugin)

    WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability

    Published 15 Oct 2026 · CVE Program
  31. High 7.1

    CVE-2026-109692 · User Registration (WordPress plugin)

    WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

    Published 15 Oct 2026 · CVE Program
  32. High 8.8

    CVE-2026-109693 · Fluent Crm (WordPress plugin)

    WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability

    Published 15 Oct 2026 · CVE Program
  33. Medium 5.4

    CVE-2026-8145 · Wholesalex (WordPress plugin)

    WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'

    Published 15 Oct 2026 · CVE Program
  34. High 7.5

    CVE-2026-109695 · Fluent Cart (WordPress plugin)

    WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

    Published 15 Oct 2026 · CVE Program
  35. Critical 9.8

    CVE-2026-109694 · Fluent Crm (WordPress plugin)

    WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability

    Published 15 Oct 2026 · CVE Program
  36. High 7.1

    CVE-2026-108491 · Everest Forms (WordPress plugin)

    WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability

    Published 15 Oct 2026 · CVE Program
  37. Critical 9.3

    CVE-2026-108497 · Ameliabooking (WordPress plugin)

    WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability

    Published 15 Oct 2026 · CVE Program
  38. High 7.1

    CVE-2026-108498 · Bsk PDF Manager (WordPress plugin)

    WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability

    Published 15 Oct 2026 · CVE Program
  39. Medium 4.3

    CVE-2026-108092 · Blog2social (WordPress plugin)

    Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure

    Published 15 Oct 2026 · CVE Program
  40. Medium 6.4

    CVE-2026-78087 · Vk Blocks (WordPress plugin)

    VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature

    Published 15 Oct 2026 · CVE Program
  41. High 7.5

    CVE-2026-15090 · Link Library (WordPress plugin)

    Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter

    Published 15 Oct 2026 · CVE Program
  42. Medium 6.1

    CVE-2026-15180 · Tracking Code Manager (WordPress plugin)

    Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'

    Published 15 Oct 2026 · CVE Program
  43. High 7.2

    CVE-2026-88043 · Mangboard (WordPress plugin)

    Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter

    Published 15 Oct 2026 · CVE Program
  44. High 7.2

    CVE-2026-18548 · Groundhogg (WordPress plugin)

    Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter

    Published 15 Oct 2026 · CVE Program
  45. High 7.2

    CVE-2026-18586 · Wpdm Premium Packages (WordPress plugin)

    Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'

    Published 15 Oct 2026 · CVE Program
  46. Medium 6.5

    CVE-2026-86803 · Ocean Extra (WordPress plugin)

    Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template

    Published 15 Oct 2026 · CVE Program
  47. Medium 6.4

    CVE-2026-14572 · Kirki (WordPress plugin)

    Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content

    Published 15 Oct 2026 · CVE Program
  48. Critical 9.8

    CVE-2026-108587 · Tenweb Speed Optimizer (WordPress plugin)

    10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter

    Published 15 Oct 2026 · CVE Program
  49. High 7.3

    CVE-2026-3712 · Phastpress (WordPress plugin)

    PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter

    Published 15 Oct 2026 · CVE Program
  50. High 7.2

    CVE-2026-119167 · Translatepress Multilingual (WordPress plugin)

    Vulnerability in TranslatePress – Translate Multilingual sites with AI Translation

    Published 15 Oct 2026 · Fixed in 3.3.9 · CVE Program, WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.