UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 7.2

    CVE-2026-96667 · Real Estate Manager (WordPress plugin)

    Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter

    Published 10 Oct 2026 · CVE Program
  2. Medium 5.3

    CVE-2026-94375 · Order Import Export For Woocommerce (WordPress plugin)

    Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()

    Published 10 Oct 2026 · CVE Program
  3. Medium 6.4

    CVE-2026-103520 · Hivepress (WordPress plugin)

    HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format

    Published 10 Oct 2026 · CVE Program
  4. Medium 4.9

    CVE-2026-104763 · Post Export Import With Media (WordPress plugin)

    Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json

    Published 10 Oct 2026 · CVE Program
  5. High 8.8

    CVE-2026-104725 · Groundhogg (WordPress plugin)

    Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter

    Published 10 Oct 2026 · CVE Program
  6. Medium 6.4

    CVE-2026-14379 · Gamipress (WordPress plugin)

    GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter

    Published 10 Oct 2026 · CVE Program
  7. Medium 6.4

    CVE-2026-16776 · Mp3 Music Player By Sonaar (WordPress plugin)

    MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

    Published 10 Oct 2026 · CVE Program
  8. High 8.8

    CVE-2026-83526 · Fv Player (WordPress plugin)

    FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter

    Published 10 Oct 2026 · CVE Program
  9. Low 3.1

    CVE-2026-104742 · Gpt3 AI Content Generator (WordPress plugin)

    AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action

    Published 10 Oct 2026 · CVE Program
  10. High 8.8

    CVE-2026-104766 · Latepoint (WordPress plugin)

    Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter

    Published 10 Oct 2026 · CVE Program
  11. Low 3.1

    CVE-2026-104741 · Gpt3 AI Content Generator (WordPress plugin)

    AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint

    Published 10 Oct 2026 · CVE Program
  12. Medium 4.9

    CVE-2026-104023 · Popup By Supsystic (WordPress plugin)

    Smart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter

    Published 10 Oct 2026 · CVE Program
  13. Medium 5.3

    CVE-2026-18496 · Booking (WordPress plugin)

    Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action

    Published 10 Oct 2026 · CVE Program
  14. Medium 4.3

    CVE-2026-91050 · Latepoint (WordPress plugin)

    Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter

    Published 10 Oct 2026 · CVE Program
  15. High 7.5

    CVE-2026-89301 · Buddypress Media (WordPress plugin)

    rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter

    Published 10 Oct 2026 · CVE Program
  16. High 7.2

    CVE-2026-104021 · Fastcache By Host It (WordPress plugin)

    Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting

    Published 10 Oct 2026 · CVE Program
  17. Medium 5.3

    CVE-2026-104724 · Firebox (WordPress plugin)

    FireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition

    Published 10 Oct 2026 · CVE Program
  18. Medium 6.1

    CVE-2026-103998 · Form Maker (WordPress plugin)

    Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key

    Published 10 Oct 2026 · CVE Program
  19. Medium 5.4

    CVE-2026-103424 · Cleantalk Spam Protect (WordPress plugin)

    Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex

    Published 10 Oct 2026 · CVE Program
  20. Medium 5.3

    CVE-2026-6723 · Simply Schedule Appointments (WordPress plugin)

    Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token

    Published 10 Oct 2026 · CVE Program
  21. Medium 6.4

    CVE-2026-104735 · Feedzy Rss Feeds (WordPress plugin)

    RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>

    Published 10 Oct 2026 · CVE Program
  22. Medium 4.3

    CVE-2026-103964 · Download Manager (WordPress plugin)

    Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email

    Published 10 Oct 2026 · CVE Program
  23. Medium 6.1

    CVE-2026-87869 · Filter Everything (WordPress plugin)

    Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL

    Published 10 Oct 2026 · CVE Program
  24. Medium 6.4

    CVE-2026-97630 · Fv Wordpress Flowplayer (WordPress plugin)

    FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute

    Published 10 Oct 2026 · CVE Program
  25. Medium 5.4

    CVE-2026-5727 · Hello Plus (WordPress plugin)

    Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site

    Published 10 Oct 2026 · CVE Program
  26. Medium 6.4

    CVE-2026-102401 · Download Manager (WordPress plugin)

    Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute

    Published 10 Oct 2026 · CVE Program
  27. Medium 4.7

    CVE-2026-101324 · Fluentform (WordPress plugin)

    Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter

    Published 10 Oct 2026 · CVE Program
  28. Critical 9.8

    CVE-2026-103889 · Expivi (WordPress plugin)

    3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter

    Published 10 Oct 2026 · CVE Program
  29. Medium 6.4

    CVE-2026-104993 · Geodirectory (WordPress plugin)

    GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field

    Published 10 Oct 2026 · CVE Program
  30. Medium 6.4

    CVE-2026-96648 · Data Tables Generator By Supsystic (WordPress plugin)

    Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action

    Published 10 Oct 2026 · CVE Program
  31. Critical 9.8

    CVE-2026-94589 · Extensions For Cf7 (WordPress plugin)

    Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload

    Published 10 Oct 2026 · CVE Program
  32. Medium 5.3

    CVE-2026-103365 · Bookly Responsive Appointment Booking Tool (WordPress plugin)

    Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details

    Published 10 Oct 2026 · CVE Program
  33. Critical 9.8

    CVE-2026-104732 · Advanced Ip Blocker (WordPress plugin)

    Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler

    Published 10 Oct 2026 · CVE Program
  34. Critical 9.1

    CVE-2026-107645 · Blocksy Companion (WordPress plugin)

    Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter

    Published 10 Oct 2026 · CVE Program
  35. High 8.1

    CVE-2026-104797 · Advanced Form Integration (WordPress plugin)

    Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action

    Published 10 Oct 2026 · CVE Program
  36. Medium 6.4

    CVE-2026-96743 · Advanced Custom Fields Table Field (WordPress plugin)

    Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value

    Published 10 Oct 2026 · CVE Program
  37. Medium 6.8

    CVE-2026-104898 · Bookly Responsive Appointment Booking Tool (WordPress plugin)

    Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body

    Published 10 Oct 2026 · CVE Program
  38. Medium 5.4

    CVE-2026-104022 · Academy (WordPress plugin)

    Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint

    Published 10 Oct 2026 · CVE Program
  39. Medium 6.4

    CVE-2026-93883 · Advanced Classifieds And Directory Pro (WordPress plugin)

    Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter

    Published 10 Oct 2026 · CVE Program
  40. Medium 6.5

    CVE-2026-104915 · Academy (WordPress plugin)

    Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id

    Published 10 Oct 2026 · CVE Program
  41. Unrated

    CVE-2026-107321 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Path Traversal

    Published 10 Oct 2026 · Fixed in 2.10.6 · WPVulnerability
  42. Unrated

    CVE-2026-104754 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 10 Oct 2026 · Fixed in 1.0.280 · WPVulnerability
  43. Unrated

    CVE-2026-104753 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: SQL Injection

    Published 10 Oct 2026 · Fixed in 1.0.280 · WPVulnerability
  44. Unrated

    CVE-2026-104752 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Unrestricted Upload of File with Dangerous Type

    Published 10 Oct 2026 · Fixed in 1.0.280 · WPVulnerability
  45. Medium 6.5

    CVE-2026-42695 · Fv Wordpress Flowplayer (WordPress plugin)

    WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  46. High 7.1

    CVE-2026-108125 · WP Post Author (WordPress plugin)

    WordPress Post Author Authenticated SQLi

    Published 9 Oct 2026 · Fixed in 4.1.0 · CVE Program
  47. Medium 4.9

    CVE-2026-108124 · WP Post Author (WordPress plugin)

    WordPress Post Author Authenticated SQLi

    Published 9 Oct 2026 · Fixed in 4.1.0 · CVE Program
  48. High 8.1

    CVE-2026-94067 · Thevoux WP (WordPress theme)

    WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability

    Published 9 Oct 2026 · CVE Program
  49. High 7.1

    CVE-2026-94066 · Pond (WordPress theme)

    WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  50. High 7.1

    CVE-2026-94063 · Education (WordPress theme)

    WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.