UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 7.5

    CVE-2026-95808 · Form Maker (WordPress plugin)

    Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter

    Published 14 Oct 2026 · CVE Program
  2. Medium 6.4

    CVE-2026-100185 · Directorist (WordPress plugin)

    Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field

    Published 14 Oct 2026 · CVE Program
  3. High 7.2

    CVE-2026-83592 · Contact Form Db For Enfold (WordPress plugin)

    Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values

    Published 14 Oct 2026 · CVE Program
  4. High 7.2

    CVE-2026-95816 · Smart Forms (WordPress plugin)

    Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter

    Published 14 Oct 2026 · CVE Program
  5. High 7.5

    CVE-2026-78193 · Woo Jtl Connector (WordPress plugin)

    JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection

    Published 14 Oct 2026 · CVE Program
  6. High 7.2

    CVE-2026-94377 · Netreviews (WordPress plugin)

    Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)

    Published 14 Oct 2026 · CVE Program
  7. Medium 6.4

    CVE-2026-97020 · Pomo Editor (WordPress plugin)

    PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter

    Published 14 Oct 2026 · CVE Program
  8. High 7.2

    CVE-2026-93885 · Cryptocurrency Donation Box (WordPress plugin)

    Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter

    Published 14 Oct 2026 · CVE Program
  9. High 7.2

    CVE-2026-77114 · Document Gallery (WordPress plugin)

    Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting

    Published 14 Oct 2026 · CVE Program
  10. Medium 6.4

    CVE-2026-16495 · Widget Countdown (WordPress plugin)

    Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute

    Published 14 Oct 2026 · CVE Program
  11. Medium 4.7

    CVE-2026-100193 · Tutor (WordPress plugin)

    Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter

    Published 14 Oct 2026 · CVE Program
  12. Medium 6.4

    CVE-2026-95807 · Fv Player (WordPress plugin)

    FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute

    Published 14 Oct 2026 · CVE Program
  13. Critical 9.8

    CVE-2026-104800 · WP Site Age Gate (WordPress plugin)

    AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php

    Published 14 Oct 2026 · CVE Program
  14. High 7.5

    CVE-2026-96661 · Grand Media (WordPress plugin)

    Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter

    Published 14 Oct 2026 · CVE Program
  15. High 7.2

    CVE-2026-103422 · Anycomment (WordPress plugin)

    AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

    Published 14 Oct 2026 · CVE Program
  16. Critical 9.8

    CVE-2026-110002 · Snazzy Cacheable Facebook Feed (WordPress plugin)

    Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter

    Published 14 Oct 2026 · CVE Program
  17. Critical 9.1

    CVE-2026-92097 · Click To Chat For Whatsapp (WordPress plugin)

    Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder

    Published 14 Oct 2026 · CVE Program
  18. High 8.1

    CVE-2026-17092 · Directorist (WordPress plugin)

    Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter

    Published 14 Oct 2026 · CVE Program
  19. High 8.1

    CVE-2026-104995 · Bp Profile Search (WordPress plugin)

    BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value

    Published 14 Oct 2026 · CVE Program
  20. High 7.5

    CVE-2026-104767 · Dfx Woo Role Changer (WordPress plugin)

    Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache

    Published 14 Oct 2026 · CVE Program
  21. Medium 5.3

    CVE-2026-107652 · Contact Form Cfdb7 (WordPress plugin)

    Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field

    Published 14 Oct 2026 · CVE Program
  22. Critical 9.8

    CVE-2026-93388 · Printcart Integration (WordPress plugin)

    Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url

    Published 14 Oct 2026 · CVE Program
  23. High 7.5

    CVE-2026-104749 · Bit Integrations (WordPress plugin)

    Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data

    Published 14 Oct 2026 · CVE Program
  24. Medium 6.4

    CVE-2026-103425 · Booking Package (WordPress plugin)

    Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

    Published 14 Oct 2026 · CVE Program
  25. High 7.5

    CVE-2026-103423 · Booking Package (WordPress plugin)

    Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'

    Published 14 Oct 2026 · CVE Program
  26. High 7.1

    CVE-2026-54851 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 14 Oct 2026 · Fixed in 2.0.3.1 · CVE Program, WPVulnerability
  27. High 8.8

    CVE-2026-1928 · SEO By Rank Math (WordPress plugin)

    Vulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

    Published 14 Oct 2026 · Fixed in 1.0.277 · CVE Program, WPVulnerability
  28. Medium 5.3

    CVE-2026-109898 · WP Event Solution (WordPress plugin)

    WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability

    Published 13 Oct 2026 · CVE Program
  29. Medium 4.3

    CVE-2026-109896 · Download Monitor Integration For Woocommerce (WordPress plugin)

    WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability

    Published 13 Oct 2026 · CVE Program
  30. Medium 5.3

    CVE-2026-109890 · Premium Addons For Elementor (WordPress plugin)

    WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability

    Published 13 Oct 2026 · CVE Program
  31. Medium 5.4

    CVE-2026-109699 · User Registration (WordPress plugin)

    WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

    Published 13 Oct 2026 · CVE Program
  32. Medium 6.5

    CVE-2026-108487 · WP Books Gallery (WordPress plugin)

    WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability

    Published 13 Oct 2026 · CVE Program
  33. Medium 5.3

    CVE-2026-106598 · User Registration (WordPress plugin)

    WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability

    Published 13 Oct 2026 · CVE Program
  34. High 7.6

    CVE-2026-109687 · Link Whisper (WordPress plugin)

    WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability

    Published 13 Oct 2026 · CVE Program
  35. Medium 6.5

    CVE-2026-105881 · User Registration (WordPress plugin)

    WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

    Published 13 Oct 2026 · CVE Program
  36. High 7.6

    CVE-2026-108179 · Bulk Editor (WordPress plugin)

    WordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability

    Published 13 Oct 2026 · CVE Program
  37. Medium 5.3

    CVE-2026-108489 · Profit Products Tables For Woocommerce (WordPress plugin)

    WordPress Active Products Tables for WooCommerce plugin <= 2.1.3 - Sensitive Data Exposure vulnerability

    Published 13 Oct 2026 · CVE Program
  38. Medium 5.4

    CVE-2026-103076 · User Registration (WordPress plugin)

    WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability

    Published 13 Oct 2026 · CVE Program
  39. Medium 5.3

    CVE-2026-108174 · Woocommerce Currency Switcher (WordPress plugin)

    WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability

    Published 13 Oct 2026 · CVE Program
  40. Medium 5.3

    CVE-2026-106597 · User Registration (WordPress plugin)

    WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

    Published 13 Oct 2026 · CVE Program
  41. Medium 6.5

    CVE-2026-109697 · Surecart (WordPress plugin)

    WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability

    Published 13 Oct 2026 · CVE Program
  42. Medium 6.5

    CVE-2026-109691 · Bdthemes Prime Slider Lite (WordPress plugin)

    WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability

    Published 13 Oct 2026 · CVE Program
  43. Medium 6.5

    CVE-2026-108488 · Powerpack Lite For Elementor (WordPress plugin)

    WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

    Published 13 Oct 2026 · CVE Program
  44. Medium 5.4

    CVE-2026-109696 · Fluent Boards (WordPress plugin)

    WordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability

    Published 13 Oct 2026 · CVE Program
  45. Medium 6.5

    CVE-2026-108490 · Premium Addons For Elementor (WordPress plugin)

    WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability

    Published 13 Oct 2026 · CVE Program
  46. Medium 5.3

    CVE-2026-109684 · Ameliabooking (WordPress plugin)

    WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

    Published 13 Oct 2026 · CVE Program
  47. Medium 5.3

    CVE-2026-108496 · WP User Manager (WordPress plugin)

    WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability

    Published 13 Oct 2026 · CVE Program
  48. Medium 5.3

    CVE-2026-108493 · Woocommerce Pay For Payment (WordPress plugin)

    WordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Control vulnerability

    Published 13 Oct 2026 · CVE Program
  49. Medium 6.5

    CVE-2026-108495 · Sureforms (WordPress plugin)

    WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability

    Published 13 Oct 2026 · CVE Program
  50. Medium 5.3

    CVE-2026-108492 · Quick Paypal Payments (WordPress plugin)

    WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability

    Published 13 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.