UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Critical 9.8

    CVE-2026-93940 · Greeny (WordPress theme)

    WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  2. Critical 9.8

    CVE-2026-93938 · Hogwords (WordPress theme)

    WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  3. Critical 9.8

    CVE-2026-93937 · Hygia (WordPress theme)

    WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  4. Critical 9.8

    CVE-2026-93936 · Ipharm (WordPress theme)

    WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  5. Critical 9.8

    CVE-2026-93935 · Playhockey (WordPress theme)

    WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  6. Critical 9.8

    CVE-2026-93934 · Partiso (WordPress theme)

    WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  7. Critical 9.8

    CVE-2026-93933 · Rosalinda (WordPress theme)

    WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  8. Critical 9.8

    CVE-2026-93932 · Smart Casa (WordPress theme)

    WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  9. Critical 9.8

    CVE-2026-93931 · Smash (WordPress theme)

    WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  10. Critical 9.8

    CVE-2026-93930 · Tantra (WordPress theme)

    WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  11. Critical 9.8

    CVE-2026-93929 · Travesia (WordPress theme)

    WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  12. Critical 9.8

    CVE-2026-93927 · Veto (WordPress plugin), Veto (WordPress theme)

    WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  13. High 7.5

    CVE-2026-93950 · Motors (WordPress theme)

    WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability

    Published 10 Oct 2026 · CVE Program
  14. High 7.1

    CVE-2026-93949 · Grocery Shopping Store (WordPress plugin), Grocery Shopping Store (WordPress theme)

    WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability

    Published 10 Oct 2026 · CVE Program
  15. High 7.2

    CVE-2026-106606 · Yith Woocommerce Affiliates (WordPress plugin)

    WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability

    Published 10 Oct 2026 · CVE Program
  16. Medium 6.4

    CVE-2026-103427 · Simple Membership (WordPress plugin)

    Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field

    Published 10 Oct 2026 · CVE Program
  17. High 7.2

    CVE-2026-96572 · WP Meteor (WordPress plugin)

    WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

    Published 10 Oct 2026 · CVE Program
  18. Low 3.7

    CVE-2026-104006 · Speedycache (WordPress plugin)

    SpeedyCache <= 1.4.2 - Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check

    Published 10 Oct 2026 · CVE Program
  19. Medium 5.3

    CVE-2026-3717 · Cv Builder (WordPress plugin)

    CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload

    Published 10 Oct 2026 · CVE Program
  20. High 7.2

    CVE-2026-107742 · Tenweb Speed Optimizer (WordPress plugin)

    10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

    Published 10 Oct 2026 · CVE Program
  21. High 7.2

    CVE-2026-100196 · Rocket Lazy Load (WordPress plugin)

    LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    Published 10 Oct 2026 · CVE Program
  22. Medium 6.4

    CVE-2026-102402 · Tlp Team (WordPress plugin)

    Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode

    Published 10 Oct 2026 · CVE Program
  23. Medium 6.4

    CVE-2026-6243 · Acf Frontend Form Element (WordPress plugin)

    Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

    Published 10 Oct 2026 · CVE Program
  24. Medium 6.5

    CVE-2026-107712 · WP Booking System (WordPress plugin)

    WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter

    Published 10 Oct 2026 · CVE Program
  25. High 7.2

    CVE-2026-100161 · Woo Photo Reviews (WordPress plugin)

    Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter

    Published 10 Oct 2026 · CVE Program
  26. Critical 9.1

    CVE-2026-104801 · Woocommerce Product Addon (WordPress plugin)

    PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter

    Published 10 Oct 2026 · CVE Program
  27. Medium 4.4

    CVE-2026-103897 · Responsive Lightbox (WordPress plugin)

    Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute

    Published 10 Oct 2026 · CVE Program
  28. Medium 6.1

    CVE-2026-89100 · Woo Stripe Payment (WordPress plugin)

    Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment

    Published 10 Oct 2026 · CVE Program
  29. High 7.2

    CVE-2026-12626 · Bookly Responsive Appointment Booking Tool (WordPress plugin)

    Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter

    Published 10 Oct 2026 · CVE Program
  30. Medium 6.5

    CVE-2026-97348 · So Widgets Bundle (WordPress plugin)

    SiteOrigin Widgets Bundle <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable)

    Published 10 Oct 2026 · CVE Program
  31. High 7.2

    CVE-2026-95684 · Vikbooking (WordPress plugin)

    VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter

    Published 10 Oct 2026 · CVE Program
  32. High 7.2

    CVE-2026-96840 · Ultimate Post (WordPress plugin)

    Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field

    Published 10 Oct 2026 · CVE Program
  33. Medium 6.4

    CVE-2026-96574 · WP User Frontend (WordPress plugin)

    User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter

    Published 10 Oct 2026 · CVE Program
  34. Medium 5.4

    CVE-2026-15178 · Fluentform (WordPress plugin)

    Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification

    Published 10 Oct 2026 · CVE Program
  35. High 7.2

    CVE-2026-96558 · Quiz Master Next (WordPress plugin)

    Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter

    Published 10 Oct 2026 · CVE Program
  36. Medium 6.1

    CVE-2026-12054 · Download Manager (WordPress plugin)

    Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter

    Published 10 Oct 2026 · CVE Program
  37. High 7.2

    CVE-2026-14335 · Easy Digital Downloads (WordPress plugin)

    Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters

    Published 10 Oct 2026 · CVE Program
  38. Medium 6.4

    CVE-2026-14882 · Brizy (WordPress plugin)

    Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta

    Published 10 Oct 2026 · CVE Program
  39. Medium 4.7

    CVE-2026-103912 · Jetformbuilder (WordPress plugin)

    JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer

    Published 10 Oct 2026 · CVE Program
  40. Medium 5.4

    CVE-2026-103482 · Newsletter Optin Box (WordPress plugin)

    Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot

    Published 10 Oct 2026 · CVE Program
  41. Medium 6.4

    CVE-2026-14877 · Data Tables Generator By Supsystic (WordPress plugin)

    Data Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute

    Published 10 Oct 2026 · CVE Program
  42. High 7.2

    CVE-2026-93775 · Podlove Podcasting Plugin For Wordpress (WordPress plugin)

    Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook

    Published 10 Oct 2026 · CVE Program
  43. Medium 6.4

    CVE-2026-97643 · Give (WordPress plugin)

    GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes

    Published 10 Oct 2026 · CVE Program
  44. High 8.8

    CVE-2026-104723 · Lifterlms (WordPress plugin)

    LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data

    Published 10 Oct 2026 · CVE Program
  45. Medium 6.4

    CVE-2026-104762 · Kadence Blocks (WordPress plugin)

    Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute

    Published 10 Oct 2026 · CVE Program
  46. High 7.2

    CVE-2026-96682 · Presto Player (WordPress plugin)

    Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag

    Published 10 Oct 2026 · CVE Program
  47. High 8.1

    CVE-2026-92975 · Groundhogg (WordPress plugin)

    Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion

    Published 10 Oct 2026 · CVE Program
  48. High 8.1

    CVE-2026-104899 · Geodirectory (WordPress plugin)

    GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter

    Published 10 Oct 2026 · CVE Program
  49. Medium 6.4

    CVE-2026-18558 · Embed Any Document (WordPress plugin)

    Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode

    Published 10 Oct 2026 · CVE Program
  50. High 8.8

    CVE-2026-77183 · Foosales (WordPress plugin)

    FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint

    Published 10 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.