UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 4.9

    CVE-2026-15399 · Animated Number Counters (WordPress plugin)

    Animated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter

    Published 13 Oct 2026 · CVE Program
  2. High 7.2

    CVE-2026-102007 · Bit Integrations (WordPress plugin)

    Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback

    Published 13 Oct 2026 · CVE Program
  3. High 7.2

    CVE-2026-102562 · Acymailing (WordPress plugin)

    AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter

    Published 13 Oct 2026 · CVE Program
  4. Medium 4.3

    CVE-2026-89097 · Ad Inserter (WordPress plugin)

    Ad Inserter <= 2.8.18 - Authenticated (Subscriber+) Sensitive Information Disclosure in 'ai-debug-processing-fe' & 'ai-debug-meta' URL Parameters

    Published 13 Oct 2026 · CVE Program
  5. Medium 5.3

    CVE-2026-109703 · WP Graphql (WordPress plugin)

    WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability

    Published 13 Oct 2026 · CVE Program
  6. Medium 6.5

    CVE-2026-54867 · Responsive Slider (WordPress plugin)

    WordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerability

    Published 13 Oct 2026 · CVE Program
  7. Medium 6.5

    CVE-2026-54868 · Fv All In One SEO Pack (WordPress plugin)

    WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability

    Published 13 Oct 2026 · CVE Program
  8. Medium 6.5

    CVE-2026-54869 · Idx Broker Platinum (WordPress plugin)

    WordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability

    Published 13 Oct 2026 · CVE Program
  9. Medium 6.5

    CVE-2026-54870 · Weaverx Theme Support (WordPress plugin)

    WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability

    Published 13 Oct 2026 · CVE Program
  10. Medium 5.4

    CVE-2026-61994 · WP Members (WordPress plugin)

    WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability

    Published 12 Oct 2026 · CVE Program
  11. Low 3.7

    CVE-2026-42689 · Events Manager (WordPress plugin)

    WordPress Events Manager plugin <= 7.4.7 - Race Condition vulnerability

    Published 12 Oct 2026 · CVE Program
  12. High 8.1

    CVE-2026-108479 · Patreon Connect (WordPress plugin)

    WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability

    Published 12 Oct 2026 · CVE Program
  13. High 7.4

    CVE-2026-108481 · Patreon Connect (WordPress plugin)

    WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability

    Published 12 Oct 2026 · CVE Program
  14. Medium 5.3

    CVE-2026-103080 · Woo Boost Sales (WordPress plugin)

    WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability

    Published 12 Oct 2026 · CVE Program
  15. Medium 6.5

    CVE-2026-108482 · Premium Addons For Elementor (WordPress plugin)

    WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability

    Published 12 Oct 2026 · CVE Program
  16. Medium 6.5

    CVE-2026-107862 · Quiz Master Next (WordPress plugin)

    WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability

    Published 12 Oct 2026 · CVE Program
  17. Medium 5.3

    CVE-2026-108486 · Forminator (WordPress plugin)

    WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability

    Published 12 Oct 2026 · CVE Program
  18. Medium 5.4

    CVE-2026-107418 · Booktics (WordPress plugin)

    WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability

    Published 12 Oct 2026 · CVE Program
  19. Medium 6.5

    CVE-2026-108478 · Bdthemes Element Pack Lite (WordPress plugin)

    WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability

    Published 12 Oct 2026 · CVE Program
  20. Medium 4.3

    CVE-2026-108475 · Videowhisper Live Streaming Integration (WordPress plugin)

    WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability

    Published 12 Oct 2026 · CVE Program
  21. Medium 5.0

    CVE-2026-108476 · Ppv Live Webcams (WordPress plugin)

    WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability

    Published 12 Oct 2026 · CVE Program
  22. Medium 5.3

    CVE-2026-108477 · Booktics (WordPress plugin)

    WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability

    Published 12 Oct 2026 · CVE Program
  23. Medium 6.5

    CVE-2026-107864 · Ad Inserter (WordPress plugin)

    WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

    Published 12 Oct 2026 · CVE Program
  24. Medium 6.5

    CVE-2026-107865 · Jet Menu (WordPress plugin)

    WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

    Published 12 Oct 2026 · CVE Program
  25. Medium 6.5

    CVE-2026-107866 · Jet Elements (WordPress plugin)

    WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability

    Published 12 Oct 2026 · CVE Program
  26. Medium 4.3

    CVE-2026-107423 · WP User Manager (WordPress plugin)

    WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability

    Published 12 Oct 2026 · CVE Program
  27. Medium 4.3

    CVE-2026-107869 · Flexible Subscriptions (WordPress plugin)

    WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability

    Published 12 Oct 2026 · CVE Program
  28. Medium 5.3

    CVE-2026-107863 · Woo Products Restricted Users (WordPress plugin)

    WordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control vulnerability

    Published 12 Oct 2026 · CVE Program
  29. Medium 6.5

    CVE-2026-108168 · Post Type Archive Mapping (WordPress plugin)

    WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability

    Published 12 Oct 2026 · CVE Program
  30. Medium 6.5

    CVE-2023-25996 · Booster Elite For Woocommerce (WordPress plugin)

    WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability

    Published 12 Oct 2026 · Fixed in 8.4.0 · CVE Program
  31. Medium 5.4

    CVE-2026-107432 · Event Post (WordPress plugin)

    WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability

    Published 12 Oct 2026 · CVE Program
  32. Medium 5.4

    CVE-2026-103356 · Tmds Dropshipping For Temu And Woo (WordPress plugin)

    WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability

    Published 12 Oct 2026 · CVE Program
  33. Medium 5.4

    CVE-2026-107430 · Videowhisper Site Manager (WordPress plugin)

    WordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin <= 1.2.10 - Broken Access Control vulnerability

    Published 12 Oct 2026 · CVE Program
  34. Medium 4.3

    CVE-2026-107429 · Ppv Live Webcams (WordPress plugin)

    WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability

    Published 12 Oct 2026 · CVE Program
  35. Medium 6.5

    CVE-2026-107427 · Event Post (WordPress plugin)

    WordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability

    Published 12 Oct 2026 · CVE Program
  36. Medium 5.3

    CVE-2026-106605 · Flexible Quantity Measurement Price Calculator For Woocommerce (WordPress plugin)

    WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability

    Published 12 Oct 2026 · CVE Program
  37. High 7.1

    CVE-2026-108695 · Dc Woocommerce Multi Vendor (WordPress plugin)

    MultiVendorX through 5.0.19 Incorrect Authorization via Settings REST Endpoint

    Published 11 Oct 2026 · CVE Program
  38. Medium 4.3

    CVE-2026-103685 · Woo Alidropship (WordPress plugin)

    WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerability

    Published 10 Oct 2026 · CVE Program
  39. High 7.2

    CVE-2026-27350 · Builderius (WordPress plugin)

    WordPress Builderius plugin <= 1.4-beta - Server Side Request Forgery (SSRF) vulnerability

    Published 10 Oct 2026 · CVE Program
  40. Medium 5.3

    CVE-2026-66480 · Yith Woocommerce Product Add Ons (WordPress plugin)

    WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability

    Published 10 Oct 2026 · CVE Program
  41. High 7.1

    CVE-2026-57742 · Kidsplanet (WordPress theme)

    WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  42. Medium 5.4

    CVE-2026-107434 · Paid Membership (WordPress plugin)

    WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability

    Published 10 Oct 2026 · CVE Program
  43. Medium 5.3

    CVE-2026-107420 · Cryptocurrency Payments Using Metamask For Woocommerce (WordPress plugin)

    WordPress Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway plugin <= 1.7.2 - Bypass Vulnerability vulnerability

    Published 10 Oct 2026 · CVE Program
  44. Critical 9.8

    CVE-2026-81797 · Buzzstone (WordPress theme)

    WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  45. Critical 9.8

    CVE-2026-78535 · Photolia (WordPress theme)

    WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  46. High 7.1

    CVE-2026-78534 · Educavo (WordPress theme)

    WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  47. Critical 9.8

    CVE-2026-78533 · Qwery (WordPress theme)

    WordPress Qwery theme <= 3.6.1 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  48. High 7.1

    CVE-2026-78532 · Lms (WordPress theme)

    WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  49. Critical 9.8

    CVE-2026-78531 · Jacqueline (WordPress theme)

    WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  50. High 7.7

    CVE-2026-78530 · Foodbakery (WordPress theme)

    WordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerability

    Published 10 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.