UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 8.1

    CVE-2026-40777 · Wpsection (WordPress plugin)

    WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability

    Published 10 Oct 2026 · CVE Program
  2. High 8.1

    CVE-2026-39802 · Everest Backup (WordPress plugin)

    WordPress Everest Backup plugin <= 2.3.13 - Remote Code Execution (RCE) vulnerability

    Published 10 Oct 2026 · CVE Program
  3. Critical 9.8

    CVE-2026-39801 · AI Copilot Content Generator (WordPress plugin)

    WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability

    Published 10 Oct 2026 · CVE Program
  4. High 7.1

    CVE-2026-39800 · Additional Order Filters For Woocommerce (WordPress plugin)

    WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  5. High 7.1

    CVE-2026-39799 · WP File Download (WordPress plugin)

    WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  6. Medium 6.5

    CVE-2026-94590 · Sell Downloads (WordPress plugin)

    WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability

    Published 10 Oct 2026 · CVE Program
  7. High 7.1

    CVE-2026-57806 · Martfury (WordPress theme)

    WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  8. Critical 9.8

    CVE-2026-106610 · Miniorange Otp Verification (WordPress plugin)

    WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability

    Published 10 Oct 2026 · CVE Program
  9. High 8.2

    CVE-2026-96341 · Forminator (WordPress plugin)

    WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability

    Published 10 Oct 2026 · CVE Program
  10. Critical 9.8

    CVE-2026-105892 · Buddypress Media (WordPress plugin)

    WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability

    Published 10 Oct 2026 · CVE Program
  11. Critical 9.3

    CVE-2026-105889 · Tickera Event Ticketing System (WordPress plugin)

    WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  12. Critical 9.8

    CVE-2026-104398 · Affi Affiliate Marketing For Woo (WordPress plugin)

    WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  13. High 7.5

    CVE-2026-103071 · Woo Thank You Page Customizer (WordPress plugin)

    WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  14. Medium 6.9

    CVE-2026-103357 · Gift4u Gift Cards All In One For Woo (WordPress plugin)

    WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability

    Published 10 Oct 2026 · CVE Program
  15. High 7.5

    CVE-2026-106609 · Bayarcash Wc (WordPress plugin)

    WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability

    Published 10 Oct 2026 · CVE Program
  16. High 7.1

    CVE-2026-94160 · Themestek Labtechco Extras (WordPress plugin)

    WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  17. High 7.2

    CVE-2026-62044 · Super Video Player (WordPress plugin)

    WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  18. Medium 5.9

    CVE-2026-66435 · WP Rollback (WordPress plugin)

    WordPress WP Rollback plugin <= 3.1.2 - Sensitive Data Exposure vulnerability

    Published 10 Oct 2026 · CVE Program
  19. High 7.1

    CVE-2026-97264 · Wpadverts (WordPress plugin)

    WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  20. High 7.1

    CVE-2026-97263 · Wpadverts (WordPress plugin)

    WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  21. High 7.2

    CVE-2026-94676 · Tainacan (WordPress plugin)

    WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  22. High 8.8

    CVE-2026-105885 · Slider Wd (WordPress plugin)

    WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  23. High 7.1

    CVE-2026-102388 · Forminator (WordPress plugin)

    WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  24. High 7.2

    CVE-2026-107657 · Hivepress (WordPress plugin)

    HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form

    Published 10 Oct 2026 · CVE Program
  25. Medium 6.4

    CVE-2026-4791 · Peprodev Ups (WordPress plugin)

    PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute

    Published 10 Oct 2026 · CVE Program
  26. Medium 4.9

    CVE-2026-104722 · Listdom (WordPress plugin)

    Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'ix[file]' Parameter

    Published 10 Oct 2026 · CVE Program
  27. High 7.1

    CVE-2026-93951 · Zeinet (WordPress theme)

    WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 10 Oct 2026 · CVE Program
  28. Medium 6.4

    CVE-2026-103478 · Wpdm Premium Packages (WordPress plugin)

    Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter

    Published 10 Oct 2026 · CVE Program
  29. High 7.5

    CVE-2026-93746 · Print Invoices Packing Slip Labels For Woocommerce (WordPress plugin)

    WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Parameter

    Published 10 Oct 2026 · CVE Program
  30. Medium 5.4

    CVE-2026-102291 · Kirki (WordPress plugin)

    Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'

    Published 10 Oct 2026 · CVE Program
  31. High 8.1

    CVE-2026-104759 · Wpo365 Login (WordPress plugin)

    WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification

    Published 10 Oct 2026 · CVE Program
  32. Medium 6.4

    CVE-2026-102774 · Suredash (WordPress plugin)

    SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content

    Published 10 Oct 2026 · CVE Program
  33. Medium 4.3

    CVE-2026-104728 · Automatorwp (WordPress plugin)

    AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action

    Published 10 Oct 2026 · CVE Program
  34. Medium 6.5

    CVE-2026-96653 · Wpdirectorykit (WordPress plugin)

    WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)

    Published 10 Oct 2026 · CVE Program
  35. High 7.2

    CVE-2026-100178 · Wpadverts (WordPress plugin)

    WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter

    Published 10 Oct 2026 · CVE Program
  36. High 7.2

    CVE-2026-96765 · Wpo365 Login (WordPress plugin)

    WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)

    Published 10 Oct 2026 · CVE Program
  37. Medium 6.4

    CVE-2026-97396 · Retainful (WordPress plugin)

    Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint

    Published 10 Oct 2026 · CVE Program
  38. Critical 9.8

    CVE-2026-104803 · Wpcom Member (WordPress plugin)

    WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback

    Published 10 Oct 2026 · CVE Program
  39. High 7.2

    CVE-2026-101920 · Molongui Authorship (WordPress plugin)

    Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute

    Published 10 Oct 2026 · CVE Program
  40. High 7.5

    CVE-2026-96662 · Latepoint (WordPress plugin)

    Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter

    Published 10 Oct 2026 · CVE Program
  41. High 7.2

    CVE-2026-100147 · Funnel Builder (WordPress plugin)

    FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)

    Published 10 Oct 2026 · CVE Program
  42. Medium 6.4

    CVE-2026-96563 · Motors Car Dealership Classified Listings (WordPress plugin)

    Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter

    Published 10 Oct 2026 · CVE Program
  43. High 7.2

    CVE-2026-96278 · WP Photo Album Plus (WordPress plugin)

    WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History

    Published 10 Oct 2026 · CVE Program
  44. Critical 9.8

    CVE-2026-62045 · Booklovers (WordPress theme)

    WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  45. Critical 9.8

    CVE-2026-62046 · Gutentype (WordPress theme)

    WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  46. Critical 9.8

    CVE-2026-93945 · Balance (WordPress plugin), Balance (WordPress theme)

    WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  47. Critical 9.8

    CVE-2026-93944 · Camelia (WordPress theme)

    WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  48. Critical 9.8

    CVE-2026-93943 · Convex (WordPress theme)

    WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  49. Critical 9.8

    CVE-2026-93942 · Dwell (WordPress theme)

    WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  50. Critical 9.8

    CVE-2026-93941 · Edema (WordPress theme)

    WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.