UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Critical 9.8

    CVE-2026-62050 · Splendour (WordPress theme)

    WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  2. High 7.5

    CVE-2026-62043 · Contact Form 7 Dynamic Text Extension (WordPress plugin)

    WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability

    Published 10 Oct 2026 · CVE Program
  3. High 7.3

    CVE-2026-62038 · Eroom Zoom Meetings Webinar (WordPress plugin)

    WordPress eRoom plugin <= 1.7.1 - Broken Authentication vulnerability

    Published 10 Oct 2026 · CVE Program
  4. High 7.1

    CVE-2026-62037 · Document Emberdder (WordPress plugin)

    WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  5. Medium 6.3

    CVE-2026-62035 · Upcasted S3 Offload (WordPress plugin)

    WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability

    Published 10 Oct 2026 · CVE Program
  6. High 7.1

    CVE-2026-62034 · Before After Image Compare (WordPress plugin)

    WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  7. High 7.6

    CVE-2026-62033 · Ulisting (WordPress plugin)

    WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability

    Published 10 Oct 2026 · CVE Program
  8. Critical 9.8

    CVE-2026-62032 · Directorypress (WordPress plugin)

    WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  9. Critical 9.3

    CVE-2026-62031 · Ulisting (WordPress plugin)

    WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  10. High 7.2

    CVE-2026-62030 · Streamcast (WordPress plugin)

    WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability

    Published 10 Oct 2026 · CVE Program
  11. High 7.1

    CVE-2026-62027 · Team Section (WordPress plugin)

    WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  12. Critical 9.0

    CVE-2026-62025 · Tailored Tools (WordPress plugin)

    WordPress Tailored Tools plugin <= 3.0.3 - Arbitrary File Upload vulnerability

    Published 10 Oct 2026 · CVE Program
  13. Critical 9.9

    CVE-2026-62024 · Codebard Help Desk (WordPress plugin)

    WordPress CodeBard Help Desk plugin <= 1.1.2 - Arbitrary File Upload vulnerability

    Published 10 Oct 2026 · CVE Program
  14. Critical 9.8

    CVE-2026-62022 · Tonda Membership (WordPress plugin)

    WordPress Tonda Membership plugin <= 1.0.1 - Privilege Escalation vulnerability

    Published 10 Oct 2026 · CVE Program
  15. High 8.8

    CVE-2026-62021 · Angio (WordPress theme)

    WordPress Angio theme <= 1.1.1 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  16. High 8.1

    CVE-2026-62020 · Touchup (WordPress theme)

    WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · Fixed in 1.4 · CVE Program
  17. High 8.1

    CVE-2026-48194 · Dukamarket (WordPress theme)

    WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  18. High 8.1

    CVE-2026-48193 · Uminex (WordPress theme)

    WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  19. High 7.6

    CVE-2026-45440 · WP Ultimate Csv Importer (WordPress plugin)

    WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  20. High 8.1

    CVE-2026-42777 · Aalto (WordPress theme)

    WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  21. High 8.1

    CVE-2026-42724 · Cleanskin (WordPress theme)

    WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  22. Critical 9.8

    CVE-2026-42723 · Cleanskin (WordPress theme)

    WordPress CleanSkin theme <= 1.5.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  23. High 7.6

    CVE-2026-42722 · Acf Frontend Form Element (WordPress plugin)

    WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  24. Critical 9.8

    CVE-2026-42719 · Dynamic User Directory (WordPress plugin)

    WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  25. Critical 9.8

    CVE-2026-42718 · Woocommerce Jetpack (WordPress plugin)

    WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  26. High 7.6

    CVE-2026-42717 · Leyka (WordPress plugin)

    WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  27. Critical 9.8

    CVE-2026-42716 · Payever Woocommerce Gateway (WordPress plugin)

    WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  28. High 7.1

    CVE-2026-42715 · Photo Gallery (WordPress plugin)

    WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  29. High 8.5

    CVE-2026-42712 · Qode Tours (WordPress plugin)

    WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  30. High 7.1

    CVE-2026-42711 · Slider Wd (WordPress plugin)

    WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  31. High 7.1

    CVE-2026-42709 · Tlp Food Menu (WordPress plugin)

    WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  32. High 7.5

    CVE-2026-42706 · Dk (WordPress theme)

    WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

    Published 10 Oct 2026 · CVE Program
  33. High 7.5

    CVE-2026-42705 · Grandnews (WordPress theme)

    WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability

    Published 10 Oct 2026 · CVE Program
  34. High 8.1

    CVE-2026-42704 · Kidscare (WordPress theme)

    WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability

    Published 10 Oct 2026 · CVE Program
  35. High 7.1

    CVE-2026-42702 · Tutor (WordPress plugin)

    WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  36. High 7.1

    CVE-2026-42699 · Fv Player (WordPress plugin)

    WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  37. High 7.1

    CVE-2026-42697 · Ultimate Social Media Plus (WordPress plugin)

    WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  38. Critical 10.0

    CVE-2026-42696 · Sitevault Backup Restore Migration (WordPress plugin)

    WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability

    Published 10 Oct 2026 · CVE Program
  39. High 7.1

    CVE-2026-42693 · Jannah (WordPress plugin), Jannah (WordPress theme)

    WordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · Fixed in 7.6.8 · CVE Program
  40. High 8.5

    CVE-2026-42633 · Events Manager (WordPress plugin)

    WordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  41. High 7.1

    CVE-2026-42632 · Qode Real Estate (WordPress plugin)

    WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  42. High 7.1

    CVE-2026-42631 · Qode Music (WordPress plugin)

    WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  43. High 7.5

    CVE-2026-42630 · Web Plura Backup Restore Manager (WordPress plugin)

    WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability

    Published 10 Oct 2026 · CVE Program
  44. Medium 5.9

    CVE-2026-42419 · Swish Migrate And Backup (WordPress plugin)

    WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerability

    Published 10 Oct 2026 · CVE Program
  45. Medium 6.5

    CVE-2026-40808 · Jetpack Videopress (WordPress plugin)

    WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability

    Published 10 Oct 2026 · CVE Program
  46. High 7.7

    CVE-2026-40805 · Peepso (WordPress plugin)

    WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability

    Published 10 Oct 2026 · CVE Program
  47. High 7.1

    CVE-2026-40803 · Jotform AI Chatbot (WordPress plugin)

    WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  48. High 7.6

    CVE-2026-40802 · Pubjet (WordPress plugin)

    WordPress Pubjet | پاب‌جت plugin <= 5.4.8 - Settings Change vulnerability

    Published 10 Oct 2026 · CVE Program
  49. High 8.1

    CVE-2026-40801 · Wordable (WordPress plugin)

    WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability

    Published 10 Oct 2026 · CVE Program
  50. Critical 9.3

    CVE-2026-40800 · Elex Bulk Edit Products Prices Attributes For Woocommerce Basic (WordPress plugin)

    WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability

    Published 10 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.