Vulnerability database · updated every hour
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 9,657
- Published in 7 days
- 230
- Critical in 30 days
- 33
- Actively exploited
- 47
Latest vulnerabilities
9,657 vulnerabilities- Medium 5.4
CVE-2026-110253 · Weforms (WordPress plugin)
weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter
Published 17 Oct 2026 · CVE Program - High 7.2
CVE-2026-100316 · Woocommerce Eu Vat Compliance (WordPress plugin)
European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header
Published 17 Oct 2026 · CVE Program - Medium 6.4
CVE-2026-109983 · Ymc Smart Filter (WordPress plugin)
YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter
Published 17 Oct 2026 · CVE Program - High 7.2
CVE-2026-111110 · Invoicing (WordPress plugin)
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter
Published 17 Oct 2026 · CVE Program - High 7.1
CVE-2026-110384 · Fancy Facebook Comments (WordPress plugin)
WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability
Published 17 Oct 2026 · CVE Program - High 8.1
CVE-2026-92798 · User Registration (WordPress plugin)
User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
Published 17 Oct 2026 · CVE Program - High 7.2
CVE-2026-103899 · Woocommerce Eu Vat Assistant (WordPress plugin)
EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter
Published 17 Oct 2026 · CVE Program - Medium 6.4
CVE-2026-109989 · Themify Popup (WordPress plugin)
Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter
Published 17 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-107744 · Learnpress (WordPress plugin)
LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
Published 17 Oct 2026 · CVE Program - Medium 6.4
CVE-2026-111726 · Themify Builder (WordPress plugin)
Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
Published 17 Oct 2026 · CVE Program - High 7.5
CVE-2026-108123 · WP Booking System (WordPress plugin)
WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action
Published 17 Oct 2026 · CVE Program - Medium 4.3
CVE-2026-92978 · User Registration (WordPress plugin)
User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()
Published 17 Oct 2026 · CVE Program - Medium 6.8
CVE-2026-109369 · WP Booking System (WordPress plugin)
WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse
Published 17 Oct 2026 · CVE Program - High 7.2
CVE-2026-96660 · User Registration (WordPress plugin)
User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
Published 17 Oct 2026 · CVE Program - Critical 9.8
CVE-2026-104736 · Learnpress (WordPress plugin)
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
Published 17 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-109368 · WP Booking System (WordPress plugin)
WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action
Published 17 Oct 2026 · CVE Program - Medium 4.3
CVE-2026-92715 · Tutor (WordPress plugin)
Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
Published 17 Oct 2026 · CVE Program - Medium 4.9
CVE-2026-107752 · Usc E Shop (WordPress plugin)
Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' Cookie
Published 17 Oct 2026 · CVE Program - Medium 6.4
CVE-2026-109985 · Xspeed (WordPress plugin)
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter
Published 17 Oct 2026 · CVE Program - Medium 4.9
CVE-2026-110268 · Post Export Import With Media (WordPress plugin)
Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter
Published 17 Oct 2026 · CVE Program - Low 3.7
CVE-2026-111602 · Latepoint (WordPress plugin)
Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter
Published 17 Oct 2026 · CVE Program - Critical 9.1
CVE-2026-110653 · Latepoint (WordPress plugin)
Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
Published 17 Oct 2026 · CVE Program - High 7.2
CVE-2026-109208 · Learnpress (WordPress plugin)
LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
Published 17 Oct 2026 · CVE Program - Medium 6.1
CVE-2026-111601 · Hippoo (WordPress plugin)
Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter
Published 17 Oct 2026 · CVE Program - High 7.2
CVE-2026-104734 · Kirki (WordPress plugin)
Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
Published 17 Oct 2026 · CVE Program - High 7.5
CVE-2026-107762 · Kirki (WordPress plugin)
Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
Published 17 Oct 2026 · CVE Program - Medium 4.3
CVE-2026-107763 · Fastcache By Host It (WordPress plugin)
Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook
Published 17 Oct 2026 · CVE Program - High 8.8
CVE-2026-97380 · MariaDB
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization…
Published 16 Oct 2026 · Fixed in 11.4.13, 11.8.9, 12.3.3 · NVD - Critical 9.9
CVE-2026-92262 · MariaDB
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under…
Published 16 Oct 2026 · Fixed in 11.4.13, 11.8.9, 12.3.3 · NVD - High 7.7
CVE-2026-86047 · MariaDB
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or…
Published 16 Oct 2026 · Fixed in 11.4.13, 11.8.9, 12.3.3 · NVD - Medium 5.4
CVE-2026-85985 · MariaDB
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling…
Published 16 Oct 2026 · Fixed in 11.4.13, 11.8.9, 12.3.3 · NVD - Critical 9.9
CVE-2026-85748 · MariaDB
MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another…
Published 16 Oct 2026 · Fixed in 12.3.3 · NVD - Critical 9.9
CVE-2026-85746 · MariaDB
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially…
Published 16 Oct 2026 · Fixed in 11.4.13, 11.8.9, 12.3.3 · NVD - Medium 4.3
CVE-2026-85745 · MariaDB
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed…
Published 16 Oct 2026 · Fixed in 11.4.13, 11.8.9, 12.3.3 · NVD - Medium 6.4
CVE-2026-97470 · Tourfic (WordPress plugin)
Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role
Published 16 Oct 2026 · CVE Program - High 8.8
CVE-2026-111413 · Athemeart Theme Helper (WordPress plugin)
WordPress aThemeArt theme Helper plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability
Published 16 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-110896 · Content Protector (WordPress plugin)
WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability
Published 16 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-111400 · Powerpack Lite For Elementor (WordPress plugin)
WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
Published 16 Oct 2026 · CVE Program - High 7.1
CVE-2026-111396 · Advanced Post Manager (WordPress plugin)
WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability
Published 16 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-111409 · Yith Paypal Express Checkout For Woocommerce (WordPress plugin)
WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability
Published 16 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-110903 · The Events Calendar (WordPress plugin)
WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability
Published 16 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-110900 · Bookit (WordPress plugin)
WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability
Published 16 Oct 2026 · CVE Program - Medium 5.4
CVE-2026-110901 · Smartcrawl SEO (WordPress plugin)
WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability
Published 16 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-110380 · WP Event Solution (WordPress plugin)
WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability
Published 16 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-111405 · Mapsvg Lite Interactive Vector Maps (WordPress plugin)
WordPress MapSVG plugin <= 8.16.1 - Cross Site Scripting (XSS) vulnerability
Published 16 Oct 2026 · CVE Program - High 8.5
CVE-2026-111399 · Mapsvg Lite Interactive Vector Maps (WordPress plugin)
WordPress MapSVG plugin <= 8.16.1 - SQL Injection vulnerability
Published 16 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-111397 · Mapsvg Lite Interactive Vector Maps (WordPress plugin)
WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability
Published 16 Oct 2026 · CVE Program - High 7.2
CVE-2026-107648 · Activitytime (WordPress plugin)
WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter
Published 16 Oct 2026 · CVE Program - Medium 4.3
CVE-2026-89280 · Dokan Lite (WordPress plugin)
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dokan/v1/customers/{id}
Published 16 Oct 2026 · CVE Program - High 7.2
CVE-2026-107758 · Colibri Page Builder (WordPress plugin)
Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments
Published 16 Oct 2026 · CVE Program
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.