UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 7.5

    CVE-2026-104768 · Automatorwp (WordPress plugin)

    AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option

    Published 7 Nov 2026 · CVE Program
  2. Medium 5.4

    CVE-2026-120683 · Testimonial Free (WordPress plugin)

    Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via Testimonial Submission Form 'tpro_client_testimonial' Parameter

    Published 7 Nov 2026 · CVE Program
  3. Medium 6.4

    CVE-2026-104760 · Wedocs (WordPress plugin)

    weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute

    Published 7 Nov 2026 · CVE Program
  4. Medium 6.5

    CVE-2026-103914 · Anywhere Elementor (WordPress plugin)

    Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter

    Published 7 Nov 2026 · CVE Program
  5. High 7.2

    CVE-2026-119183 · Jetformbuilder (WordPress plugin)

    JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta

    Published 7 Nov 2026 · CVE Program
  6. Medium 6.4

    CVE-2026-96565 · WP Members (WordPress plugin)

    WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field

    Published 7 Nov 2026 · CVE Program
  7. High 7.5

    CVE-2026-116751 · Ameliabooking (WordPress plugin)

    Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array Keys

    Published 7 Nov 2026 · CVE Program
  8. Critical 9.1

    CVE-2026-118066 · Latepoint (WordPress plugin)

    Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter

    Published 7 Nov 2026 · CVE Program
  9. Medium 6.4

    CVE-2026-122059 · WP Imageviewer (WordPress plugin)

    WP ImageViewer <= 3.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute

    Published 7 Nov 2026 · CVE Program
  10. Medium 4.9

    CVE-2026-118056 · Image Hover Effects Ultimate (WordPress plugin)

    Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) <= 9.12.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'oxi_image_comparison_before_text' Parameter

    Published 7 Nov 2026 · CVE Program
  11. Medium 6.4

    CVE-2026-118047 · Falang (WordPress plugin)

    Falang multilanguage for WordPress <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via `falang_language_ordering` AJAX / `edit_term` hook

    Published 7 Nov 2026 · CVE Program
  12. High 7.2

    CVE-2026-116537 · Link Library (WordPress plugin)

    Link Library <= 7.10.0 - Unauthenticated Stored Cross-Site Scripting via 'link_description' Parameter

    Published 7 Nov 2026 · CVE Program
  13. Medium 6.5

    CVE-2026-102564 · Anywhere Elementor (WordPress plugin)

    Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer

    Published 7 Nov 2026 · CVE Program
  14. Medium 5.3

    CVE-2026-121571 · Pay WP (WordPress plugin)

    WordPress Autopay dla WooCommerce plugin <= 2.3.0 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  15. Medium 5.3

    CVE-2026-119496 · Media Library Assistant (WordPress plugin)

    WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability

    Published 7 Nov 2026 · CVE Program
  16. Medium 4.3

    CVE-2026-123470 · Hivepress (WordPress plugin)

    WordPress HivePress plugin <= 1.8.1 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  17. Medium 5.3

    CVE-2026-119513 · JS Support Ticket (WordPress plugin)

    WordPress JS Help Desk plugin <= 5.0.3 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  18. Medium 4.3

    CVE-2026-123468 · Motors Car Dealership Classified Listings (WordPress plugin)

    WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  19. Medium 5.3

    CVE-2026-120857 · Webcam 2way Videochat (WordPress plugin)

    WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.9 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  20. Medium 5.3

    CVE-2026-123148 · Ivyforms (WordPress plugin)

    WordPress IvyForms plugin <= 1.5.1 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  21. Medium 4.3

    CVE-2026-120837 · Everest Forms (WordPress plugin)

    WordPress Everest Forms plugin <= 3.6.3 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  22. Medium 4.3

    CVE-2026-121724 · Contextual Related Posts (WordPress plugin)

    WordPress Contextual Related Posts plugin <= 4.5.3 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  23. Medium 6.5

    CVE-2026-120364 · Vidplex (WordPress plugin)

    WordPress Vidplex plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  24. Medium 5.3

    CVE-2026-119523 · Paid Member Subscriptions (WordPress plugin)

    WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  25. Medium 4.3

    CVE-2026-119525 · Dropshipping Xml For Woocommerce (WordPress plugin)

    WordPress Dropshipping XML for WooCommerce plugin <= 1.7.4 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  26. Medium 6.5

    CVE-2026-120365 · Customer Area (WordPress plugin)

    WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  27. Medium 4.3

    CVE-2026-119478 · Masterstudy Lms Learning Management System (WordPress plugin)

    WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability

    Published 7 Nov 2026 · CVE Program
  28. Medium 5.3

    CVE-2026-119508 · Radius Booking (WordPress plugin)

    WordPress Radius Booking — Booking Calendar for Appointments &amp; Services plugin <= 1.0.20 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  29. Medium 4.3

    CVE-2026-119492 · Ditty News Ticker (WordPress plugin)

    WordPress Ditty plugin <= 3.1.71 - Content Injection vulnerability

    Published 7 Nov 2026 · CVE Program
  30. Medium 6.5

    CVE-2026-119501 · Bdthemes Element Pack Lite (WordPress plugin)

    WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  31. Medium 6.5

    CVE-2026-121783 · WP Data Access (WordPress plugin)

    WordPress WP Data Access plugin <= 5.5.90 - Cross Site Request Forgery (CSRF) vulnerability

    Published 7 Nov 2026 · CVE Program
  32. Medium 5.3

    CVE-2026-119490 · Bnfw (WordPress plugin)

    WordPress Better Notifications for WP plugin <= 1.10.1 - Content Injection vulnerability

    Published 7 Nov 2026 · CVE Program
  33. Medium 4.3

    CVE-2026-119486 · Fluent Boards (WordPress plugin)

    WordPress FluentBoards plugin <= 2.2.2 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  34. Medium 6.5

    CVE-2026-119500 · Html5 Video Player (WordPress plugin)

    WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  35. Medium 4.3

    CVE-2026-120840 · User Registration (WordPress plugin)

    WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  36. Medium 5.3

    CVE-2026-120842 · Sureforms (WordPress plugin)

    WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  37. Medium 6.5

    CVE-2026-119520 · Ultimate Addons For Gutenberg (WordPress plugin)

    WordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  38. Medium 5.3

    CVE-2026-119494 · Site Reviews (WordPress plugin)

    WordPress Site Reviews plugin <= 8.3.6 - Content Injection vulnerability

    Published 7 Nov 2026 · CVE Program
  39. Medium 6.5

    CVE-2026-120850 · Elementor

    WordPress Elementor Website Builder plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  40. Medium 6.5

    CVE-2026-119493 · Ditty News Ticker (WordPress plugin)

    WordPress Ditty plugin <= 3.1.71 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  41. Medium 5.3

    CVE-2026-119507 · Notificationx (WordPress plugin)

    WordPress NotificationX plugin <= 3.3.6 - Content Injection vulnerability

    Published 7 Nov 2026 · CVE Program
  42. Medium 4.3

    CVE-2026-119473 · WP User Avatar (WordPress plugin)

    WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability

    Published 7 Nov 2026 · CVE Program
  43. Medium 5.3

    CVE-2026-119465 · Addon Elements For Elementor Page Builder (WordPress plugin)

    WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerability

    Published 7 Nov 2026 · CVE Program
  44. High 8.8

    CVE-2026-121762 · Powerpress (WordPress plugin)

    WordPress PowerPress Podcasting plugin <= 11.18.0 - Cross Site Request Forgery (CSRF) vulnerability

    Published 7 Nov 2026 · CVE Program
  45. High 7.5

    CVE-2026-107616 · Ameliabooking (WordPress plugin)

    Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Unauthenticated Arbitrary Event Attendee Data Exposure via '/report/event/attendees' Endpoint

    Published 7 Nov 2026 · CVE Program
  46. Medium 6.4

    CVE-2026-120532 · Wpforo (WordPress plugin)

    wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Reply Body in Moderation Forms

    Published 7 Nov 2026 · CVE Program
  47. High 7.5

    CVE-2026-95870 · Wpforo (WordPress plugin)

    wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter

    Published 7 Nov 2026 · CVE Program
  48. High 7.5

    CVE-2026-119164 · Wpforo (WordPress plugin)

    wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Privilege Escalation to 'data[secondary_groupids]' CSV Parameter

    Published 7 Nov 2026 · CVE Program
  49. High 8.1

    CVE-2026-103900 · Wpjam Basic (WordPress plugin)

    WPJAM Basic <= 7.1 - Unauthenticated Privilege Escalation to 'data[args][role]' Parameter

    Published 7 Nov 2026 · CVE Program
  50. Medium 6.4

    CVE-2026-118784 · Wpspeed (WordPress plugin)

    WPSpeed <= 2.6.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display Name

    Published 7 Nov 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.