UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 6.3

    CVE-2026-110762 · Bbpress (WordPress plugin)

    bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream

    Published 14 Oct 2026 · Fixed in 2.6.19 · CVE Program
  2. High 8.2

    CVE-2026-108480 · Skydropx (WordPress plugin)

    WordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerability

    Published 14 Oct 2026 · CVE Program
  3. High 7.1

    CVE-2026-108484 · WP Payment Form (WordPress plugin)

    WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability

    Published 14 Oct 2026 · CVE Program
  4. High 7.1

    CVE-2026-108483 · Hippoo (WordPress plugin)

    WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability

    Published 14 Oct 2026 · CVE Program
  5. High 7.1

    CVE-2026-105066 · Simply Rets (WordPress plugin)

    WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability

    Published 14 Oct 2026 · CVE Program
  6. Medium 5.3

    CVE-2026-108151 · WP Meta Data Filter And Taxonomy Filter (WordPress plugin)

    WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability

    Published 14 Oct 2026 · CVE Program
  7. High 7.5

    CVE-2026-103081 · Woo Boost Sales (WordPress plugin)

    WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability

    Published 14 Oct 2026 · CVE Program
  8. High 8.8

    CVE-2026-86461 · Fv Wordpress Flowplayer (WordPress plugin)

    FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter

    Published 14 Oct 2026 · CVE Program
  9. High 7.1

    CVE-2026-107870 · Jet Engine (WordPress plugin)

    WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

    Published 14 Oct 2026 · CVE Program
  10. Medium 6.5

    CVE-2026-107417 · Push Notification For Post And Buddypress (WordPress plugin)

    WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability

    Published 14 Oct 2026 · CVE Program
  11. High 7.3

    CVE-2026-107426 · Ppv Live Webcams (WordPress plugin)

    WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability

    Published 14 Oct 2026 · CVE Program
  12. Critical 9.8

    CVE-2026-108291 · Affiliates (WordPress plugin)

    WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability

    Published 14 Oct 2026 · CVE Program
  13. Medium 6.5

    CVE-2026-107425 · Bus Ticket Booking With Seat Reservation (WordPress plugin)

    WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability

    Published 14 Oct 2026 · CVE Program
  14. High 7.1

    CVE-2026-107867 · Jet Product Tables (WordPress plugin)

    WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

    Published 14 Oct 2026 · CVE Program
  15. High 7.3

    CVE-2026-107421 · Videowhisper Live Streaming Integration (WordPress plugin)

    WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability

    Published 14 Oct 2026 · CVE Program
  16. Critical 9.8

    CVE-2026-107424 · Frontend Dashboard (WordPress plugin)

    WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability

    Published 14 Oct 2026 · CVE Program
  17. Medium 6.5

    CVE-2026-107422 · WP W3all Phpbb Integration (WordPress plugin)

    WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

    Published 14 Oct 2026 · CVE Program
  18. High 7.1

    CVE-2026-105874 · Surecart (WordPress plugin)

    WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability

    Published 14 Oct 2026 · CVE Program
  19. High 8.8

    CVE-2026-106599 · Surecart (WordPress plugin)

    WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability

    Published 14 Oct 2026 · CVE Program
  20. High 7.2

    CVE-2026-97278 · Polylang (WordPress plugin)

    WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

    Published 14 Oct 2026 · CVE Program
  21. Medium 6.5

    CVE-2026-107433 · Miniorange Oauth 20 Server (WordPress plugin)

    WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability

    Published 14 Oct 2026 · CVE Program
  22. High 8.5

    CVE-2026-105067 · Modern Events Calendar Lite (WordPress plugin)

    WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability

    Published 14 Oct 2026 · Fixed in 7.37.0 · CVE Program
  23. High 7.5

    CVE-2026-103358 · Email Template Customizer For Woo (WordPress plugin)

    WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability

    Published 14 Oct 2026 · CVE Program
  24. High 7.5

    CVE-2026-107431 · Jetformbuilder (WordPress plugin)

    WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability

    Published 14 Oct 2026 · CVE Program
  25. High 7.1

    CVE-2026-107428 · Ppv Live Webcams (WordPress plugin)

    WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability

    Published 14 Oct 2026 · CVE Program
  26. Medium 4.9

    CVE-2026-107757 · Gallery Custom Links (WordPress plugin)

    Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body

    Published 14 Oct 2026 · CVE Program
  27. High 8.1

    CVE-2026-104909 · Mangboard (WordPress plugin)

    Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter

    Published 14 Oct 2026 · CVE Program
  28. High 7.2

    CVE-2026-104764 · Post Export Import With Media (WordPress plugin)

    Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter

    Published 14 Oct 2026 · CVE Program
  29. Critical 9.8

    CVE-2026-104748 · Simple Form (WordPress plugin)

    SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register

    Published 14 Oct 2026 · CVE Program
  30. Medium 6.4

    CVE-2026-107650 · Geodirectory (WordPress plugin)

    GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title

    Published 14 Oct 2026 · CVE Program
  31. Medium 6.5

    CVE-2026-103907 · Jeg Elementor Kit (WordPress plugin)

    Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action

    Published 14 Oct 2026 · CVE Program
  32. High 7.2

    CVE-2026-107631 · Record Of Consent Extension For Complianz (WordPress plugin)

    Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter

    Published 14 Oct 2026 · CVE Program
  33. High 7.2

    CVE-2026-107751 · Mangboard (WordPress plugin)

    Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter

    Published 14 Oct 2026 · CVE Program
  34. Medium 6.4

    CVE-2026-107756 · Meow Lightbox (WordPress plugin)

    Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name

    Published 14 Oct 2026 · CVE Program
  35. Medium 6.4

    CVE-2026-104761 · Mangboard (WordPress plugin)

    Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter

    Published 14 Oct 2026 · CVE Program
  36. High 7.5

    CVE-2026-110284 · Lifterlms (WordPress plugin)

    LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes

    Published 14 Oct 2026 · CVE Program
  37. High 8.1

    CVE-2026-103367 · Shopmagic For Woocommerce (WordPress plugin)

    ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter

    Published 14 Oct 2026 · CVE Program
  38. Medium 6.4

    CVE-2025-9373 · Pepro Mapify (WordPress plugin)

    PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Published 14 Oct 2026 · CVE Program
  39. Medium 4.3

    CVE-2026-103380 · Latepoint (WordPress plugin)

    Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion

    Published 14 Oct 2026 · CVE Program
  40. High 7.5

    CVE-2026-103366 · Latepoint (WordPress plugin)

    Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters

    Published 14 Oct 2026 · CVE Program
  41. High 7.4

    CVE-2026-100163 · Latepoint (WordPress plugin)

    Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback

    Published 14 Oct 2026 · CVE Program
  42. Medium 6.4

    CVE-2026-107754 · Geodirectory (WordPress plugin)

    GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title

    Published 14 Oct 2026 · CVE Program
  43. Medium 5.3

    CVE-2026-110227 · Restricted Site Access (WordPress plugin)

    WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability

    Published 14 Oct 2026 · CVE Program
  44. High 8.5

    CVE-2026-109901 · Cp Multi View Calendar (WordPress plugin)

    WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability

    Published 14 Oct 2026 · CVE Program
  45. Medium 6.5

    CVE-2026-101926 · Woo Poly Integration (WordPress plugin)

    Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter

    Published 14 Oct 2026 · CVE Program
  46. Medium 6.4

    CVE-2026-103369 · WP Share Buttons Analytics By Getsocial (WordPress plugin)

    Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX

    Published 14 Oct 2026 · CVE Program
  47. High 7.2

    CVE-2026-101924 · Newstatpress (WordPress plugin)

    NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String

    Published 14 Oct 2026 · CVE Program
  48. High 7.2

    CVE-2026-100153 · Newstatpress (WordPress plugin)

    NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)

    Published 14 Oct 2026 · CVE Program
  49. Critical 9.8

    CVE-2026-87855 · Woo Jtl Connector (WordPress plugin)

    JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method

    Published 14 Oct 2026 · CVE Program
  50. High 7.2

    CVE-2026-97398 · Fv Wordpress Flowplayer (WordPress plugin)

    FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute

    Published 14 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.