UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Critical 9.8

    CVE-2026-78529 · Alliance (WordPress theme)

    WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  2. Critical 9.8

    CVE-2026-66569 · Kicker (WordPress theme)

    WordPress Kicker theme <= 2.2.1 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  3. Critical 9.8

    CVE-2026-66568 · Original (WordPress theme)

    WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  4. Critical 9.8

    CVE-2026-66567 · Anesta (WordPress theme)

    WordPress Anesta theme <= 1.5.3 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  5. High 8.1

    CVE-2026-66566 · Ambient (WordPress theme)

    WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  6. Critical 9.8

    CVE-2026-66565 · Fcunited (WordPress theme)

    WordPress FC United theme <= 1.1.1 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  7. Critical 9.8

    CVE-2026-66564 · Shift Cv (WordPress theme)

    WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  8. Critical 9.8

    CVE-2026-66563 · Windsor (WordPress theme)

    WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  9. Critical 9.8

    CVE-2026-66483 · Education (WordPress theme)

    WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  10. Critical 9.8

    CVE-2026-66482 · Drone Media (WordPress theme)

    WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  11. Medium 6.8

    CVE-2026-66481 · Presto Player Pro (WordPress plugin)

    WordPress Presto Player Pro plugin <= 3.0.1 - Arbitrary File Deletion vulnerability

    Published 10 Oct 2026 · CVE Program
  12. High 7.5

    CVE-2026-65459 · Forminator (WordPress plugin)

    WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability

    Published 10 Oct 2026 · CVE Program
  13. High 7.2

    CVE-2026-62130 · Woocommerce Multilingual (WordPress plugin)

    WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.8 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  14. Critical 9.9

    CVE-2026-62129 · Creatorlms (WordPress plugin)

    WordPress Creator LMS plugin <= 1.2.21 - Arbitrary File Upload vulnerability

    Published 10 Oct 2026 · CVE Program
  15. Critical 9.8

    CVE-2026-62125 · Asia Garden (WordPress theme)

    WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  16. Critical 9.8

    CVE-2026-62124 · N7 Golf Club (WordPress theme)

    WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  17. Critical 9.8

    CVE-2026-62123 · Invetex (WordPress theme)

    WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  18. Critical 9.8

    CVE-2026-62120 · Law Office (WordPress theme)

    WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  19. High 7.3

    CVE-2026-62118 · Barcode Scanner Lite Pos To Manage Products Inventory And Orders (WordPress plugin)

    WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability

    Published 10 Oct 2026 · CVE Program
  20. High 8.5

    CVE-2026-62117 · Barcode Scanner Lite Pos To Manage Products Inventory And Orders (WordPress plugin)

    WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  21. High 7.1

    CVE-2026-62116 · Barcode Scanner Lite Pos To Manage Products Inventory And Orders (WordPress plugin)

    WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  22. High 8.1

    CVE-2026-62115 · Kuteshop (WordPress theme)

    WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  23. High 7.1

    CVE-2026-62100 · Kuteshop (WordPress theme)

    WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  24. High 8.1

    CVE-2026-62099 · Kute Boutique (WordPress theme)

    WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  25. Medium 6.5

    CVE-2026-62098 · Kute Boutique (WordPress theme)

    WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability

    Published 10 Oct 2026 · CVE Program
  26. High 8.1

    CVE-2026-62096 · Biolife (WordPress theme)

    WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  27. High 7.1

    CVE-2026-62095 · Biolife (WordPress theme)

    WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  28. High 8.1

    CVE-2026-62094 · Techone (WordPress theme)

    WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  29. High 7.1

    CVE-2026-62093 · Techone (WordPress theme)

    WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  30. High 8.1

    CVE-2026-62092 · Armania (WordPress theme)

    WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  31. High 7.1

    CVE-2026-62091 · Armania (WordPress theme)

    WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  32. Critical 9.8

    CVE-2026-62090 · Wineshop (WordPress theme)

    WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  33. Critical 9.8

    CVE-2026-62087 · Equadio (WordPress theme)

    WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  34. Critical 9.8

    CVE-2026-62086 · Junotoys (WordPress theme)

    WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  35. High 7.1

    CVE-2026-62082 · Pin WP (WordPress theme)

    WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  36. Critical 9.8

    CVE-2026-62077 · Avala (WordPress theme)

    WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  37. Critical 9.8

    CVE-2026-62076 · Kalles (WordPress theme)

    WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  38. High 8.1

    CVE-2026-62075 · Backhoe (WordPress theme)

    WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  39. High 8.1

    CVE-2026-62074 · Ozeum (WordPress theme)

    WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  40. High 8.1

    CVE-2026-62070 · Flipmart (WordPress theme)

    WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  41. High 8.1

    CVE-2026-62069 · Fabius WP (WordPress theme)

    WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  42. High 8.1

    CVE-2026-62068 · Teoro WP (WordPress theme)

    WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  43. High 8.1

    CVE-2026-62067 · Kaven WP (WordPress theme)

    WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  44. High 8.1

    CVE-2026-62066 · Volos WP (WordPress theme)

    WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  45. High 8.1

    CVE-2026-62065 · Cardea WP (WordPress theme)

    WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  46. High 7.1

    CVE-2026-62064 · Ambed (WordPress theme)

    WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  47. Critical 9.8

    CVE-2026-62054 · Yacht Rental (WordPress theme)

    WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  48. Critical 9.8

    CVE-2026-62053 · Wine House (WordPress theme)

    WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  49. Critical 9.8

    CVE-2026-62052 · Tipsy (WordPress theme)

    WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  50. Critical 9.8

    CVE-2026-62051 · Stargaze (WordPress theme)

    WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.