UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 8.8

    CVE-2026-94065 · Colorit (WordPress theme)

    WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability

    Published 9 Oct 2026 · CVE Program
  2. High 8.8

    CVE-2026-94064 · Neocut (WordPress theme)

    WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability

    Published 9 Oct 2026 · CVE Program
  3. High 7.1

    CVE-2026-62026 · Dashboard Notes (WordPress plugin)

    WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability

    Published 9 Oct 2026 · CVE Program
  4. High 8.1

    CVE-2026-94062 · Werkstatt (WordPress plugin), Werkstatt (WordPress theme)

    WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability

    Published 9 Oct 2026 · CVE Program
  5. High 7.1

    CVE-2026-94061 · Whistle Sports Club (WordPress theme)

    WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  6. High 7.1

    CVE-2026-94060 · Voldor (WordPress theme)

    WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  7. High 7.1

    CVE-2026-94059 · Ogency (WordPress theme)

    WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  8. High 7.1

    CVE-2026-94058 · Treck (WordPress theme)

    WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  9. Medium 5.4

    CVE-2026-62028 · Before After Image Compare (WordPress plugin)

    WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability

    Published 9 Oct 2026 · CVE Program
  10. High 7.1

    CVE-2026-105883 · Th Shop Mania (WordPress plugin), Th Shop Mania (WordPress theme)

    WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability

    Published 9 Oct 2026 · CVE Program
  11. High 8.8

    CVE-2026-104392 · Quiz Master Next (WordPress plugin)

    WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability

    Published 9 Oct 2026 · CVE Program
  12. High 7.1

    CVE-2026-105870 · WP Associate Post R2 (WordPress plugin)

    WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  13. High 7.2

    CVE-2026-105872 · Product Configurator For Woocommerce (WordPress plugin)

    WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability

    Published 9 Oct 2026 · CVE Program
  14. Medium 6.9

    CVE-2026-105877 · Qa Heatmap Analytics (WordPress plugin)

    WordPress QA Analytics plugin <= 5.3.0.0 - Sensitive Data Exposure vulnerability

    Published 9 Oct 2026 · CVE Program
  15. High 7.1

    CVE-2026-105318 · Acymailing (WordPress plugin)

    WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  16. Medium 5.3

    CVE-2026-104079 · Envira Gallery Lite (WordPress plugin)

    Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint

    Published 9 Oct 2026 · Fixed in 1.16.2 · CVE Program
  17. Medium 6.5

    CVE-2026-62029 · Wpfunnels (WordPress plugin)

    WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  18. Medium 4.3

    CVE-2026-62036 · All Bootstrap Blocks (WordPress plugin)

    WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability

    Published 9 Oct 2026 · CVE Program
  19. Medium 4.3

    CVE-2026-39779 · Asgaros Forum (WordPress plugin)

    WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability

    Published 9 Oct 2026 · CVE Program
  20. Medium 6.5

    CVE-2026-62039 · Html5 Audio Player (WordPress plugin)

    WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  21. Medium 5.3

    CVE-2026-62040 · Restrict User Access (WordPress plugin)

    WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability

    Published 9 Oct 2026 · CVE Program
  22. Medium 5.4

    CVE-2026-62041 · WP Event Manager (WordPress plugin)

    WordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability

    Published 9 Oct 2026 · CVE Program
  23. Medium 5.3

    CVE-2026-62042 · Scripts N Styles (WordPress plugin)

    WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability

    Published 9 Oct 2026 · CVE Program
  24. Medium 5.4

    CVE-2026-107419 · Automatic Translations For Polylang (WordPress plugin)

    WordPress AI Translation for Polylang plugin <= 1.6.2 - Broken Access Control vulnerability

    Published 9 Oct 2026 · CVE Program
  25. Critical 9.3

    CVE-2026-93947 · Traveler (WordPress plugin), Traveler (WordPress theme)

    WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability

    Published 9 Oct 2026 · CVE Program
  26. High 7.1

    CVE-2026-94158 · Gloria Admin Panel (WordPress plugin)

    WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  27. Critical 10.0

    CVE-2026-94503 · Zombify (WordPress plugin)

    WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

    Published 9 Oct 2026 · CVE Program
  28. High 7.1

    CVE-2026-94161 · Grandrestaurant (WordPress plugin), Grandrestaurant (WordPress theme)

    WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · Fixed in 7.0.11 · CVE Program
  29. High 7.1

    CVE-2026-94159 · Totaldonations (WordPress plugin)

    WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  30. High 7.1

    CVE-2026-94167 · Kubio (WordPress plugin)

    WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  31. Medium 5.6

    CVE-2026-96334 · User Registration (WordPress plugin)

    WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

    Published 9 Oct 2026 · CVE Program
  32. High 7.1

    CVE-2026-94170 · Sassy Social Share (WordPress plugin)

    WordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  33. High 7.5

    CVE-2026-94664 · PDF For Contact Form 7 (WordPress plugin)

    WordPress PDF for Contact Form 7 plugin <= 7.1.0 - Arbitrary File Download vulnerability

    Published 9 Oct 2026 · CVE Program
  34. High 7.1

    CVE-2026-96607 · Nex Forms Express WP Form Builder (WordPress plugin)

    WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  35. High 7.5

    CVE-2026-94666 · Generate PDF Using Contact Form 7 (WordPress plugin)

    WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability

    Published 9 Oct 2026 · CVE Program
  36. High 7.1

    CVE-2026-96332 · Simple Payment (WordPress plugin)

    WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  37. Medium 6.5

    CVE-2026-95589 · Advanced Partial Payment Or Deposit For Woocommerce (WordPress plugin)

    WordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Control vulnerability

    Published 9 Oct 2026 · CVE Program
  38. High 7.1

    CVE-2026-94668 · Salon Booking System (WordPress plugin)

    WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  39. Medium 6.5

    CVE-2026-94667 · Jet Reviews (WordPress plugin)

    WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  40. Medium 6.5

    CVE-2026-94665 · Classified Listing (WordPress plugin)

    WordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  41. High 8.5

    CVE-2026-94663 · Profilegrid User Profiles Groups And Communities (WordPress plugin)

    WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability

    Published 9 Oct 2026 · CVE Program
  42. High 7.1

    CVE-2026-94661 · Jet Blog (WordPress plugin)

    WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  43. High 7.1

    CVE-2026-94641 · Userswp (WordPress plugin)

    WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  44. High 7.1

    CVE-2026-94632 · Blockstrap Page Builder Blocks (WordPress plugin)

    WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  45. Critical 9.3

    CVE-2026-96809 · Eduadmin Booking (WordPress plugin)

    WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability

    Published 9 Oct 2026 · Fixed in 6.0.0 · CVE Program
  46. High 7.1

    CVE-2026-94415 · Betheme (WordPress plugin), Betheme (WordPress theme)

    WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  47. High 7.1

    CVE-2026-94166 · Us Core (WordPress plugin)

    WordPress UpSolution Core plugin <= 8.44 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  48. High 7.1

    CVE-2026-96761 · Usc E Shop (WordPress plugin)

    WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  49. High 8.8

    CVE-2026-96671 · Featured Image From URL (WordPress plugin)

    WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability

    Published 9 Oct 2026 · CVE Program
  50. Critical 9.3

    CVE-2026-96331 · Ajax Search Pro (WordPress plugin)

    WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability

    Published 9 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.