UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Critical 9.3

    CVE-2026-96330 · Td Subscription (WordPress plugin)

    WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability

    Published 9 Oct 2026 · CVE Program
  2. High 8.5

    CVE-2026-96329 · Td Subscription (WordPress plugin)

    WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability

    Published 9 Oct 2026 · CVE Program
  3. Critical 9.3

    CVE-2026-96328 · Jnews Pay Writer (WordPress plugin)

    WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability

    Published 9 Oct 2026 · CVE Program
  4. High 7.1

    CVE-2026-95609 · Media Library Assistant (WordPress plugin)

    WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  5. High 8.5

    CVE-2026-95599 · Taskbuilder (WordPress plugin)

    WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability

    Published 9 Oct 2026 · CVE Program
  6. High 7.1

    CVE-2026-95598 · Search In Place (WordPress plugin)

    WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  7. Medium 6.5

    CVE-2026-95597 · Pgall For Woocommerce (WordPress plugin)

    WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability

    Published 9 Oct 2026 · CVE Program
  8. High 7.1

    CVE-2026-95596 · Shopbuilder (WordPress plugin)

    WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  9. High 7.1

    CVE-2026-95591 · Vikbooking (WordPress plugin)

    WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  10. High 7.2

    CVE-2026-94568 · Woo Vipps (WordPress plugin)

    WordPress Pay with Vipps for WooCommerce plugin <= 6.2.0 - PHP Object Injection vulnerability

    Published 9 Oct 2026 · CVE Program
  11. High 8.5

    CVE-2026-95607 · Wplms (WordPress plugin), Wplms (WordPress theme)

    WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability

    Published 9 Oct 2026 · CVE Program
  12. Critical 9.3

    CVE-2026-96327 · Wplms Plugin (WordPress plugin)

    WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability

    Published 9 Oct 2026 · Fixed in 1.9.9.8.2 · CVE Program
  13. High 7.1

    CVE-2026-95608 · Woocommerce Products Filter (WordPress plugin)

    WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  14. High 8.5

    CVE-2026-95610 · Us Core (WordPress plugin)

    WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability

    Published 9 Oct 2026 · CVE Program
  15. High 7.5

    CVE-2026-96461 · Ameliabooking (WordPress plugin)

    WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

    Published 9 Oct 2026 · CVE Program
  16. Medium 6.5

    CVE-2026-96337 · WP User Avatar (WordPress plugin)

    WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

    Published 9 Oct 2026 · CVE Program
  17. Medium 5.9

    CVE-2026-96518 · WP User Avatar (WordPress plugin)

    WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

    Published 9 Oct 2026 · CVE Program
  18. High 7.5

    CVE-2026-96333 · Give (WordPress plugin)

    WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability

    Published 9 Oct 2026 · CVE Program
  19. High 7.1

    CVE-2026-96553 · Ajax Search For Woocommerce (WordPress plugin)

    WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  20. Medium 5.6

    CVE-2026-96539 · Ultimate Member (WordPress plugin)

    WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability

    Published 9 Oct 2026 · CVE Program
  21. High 7.5

    CVE-2026-96336 · Forminator (WordPress plugin)

    WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability

    Published 9 Oct 2026 · CVE Program
  22. Medium 6.5

    CVE-2026-62049 · Jet Blocks (WordPress plugin)

    WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability

    Published 9 Oct 2026 · CVE Program
  23. Medium 6.8

    CVE-2025-14123 · Redux Framework (WordPress plugin)

    Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension

    Published 9 Oct 2026 · CVE Program
  24. High 7.5

    CVE-2026-97076 · WP Rocket (WordPress plugin)

    Vulnerability in WP Rocket

    Published 9 Oct 2026 · Fixed in 3.23.5 · CVE Program, WPVulnerability
  25. Medium 6.5

    CVE-2026-97075 · WP Rocket (WordPress plugin)

    Vulnerability in WP Rocket

    Published 9 Oct 2026 · Fixed in 3.23.5 · CVE Program, WPVulnerability
  26. Medium 5.3

    CVE-2026-82844 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Insufficient Verification of Data Authenticity

    Published 9 Oct 2026 · Fixed in 2.0.2.2 · WPVulnerability
  27. High 7.1

    CVE-2026-40804 · Ablocks (WordPress plugin)

    WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability

    Published 8 Oct 2026 · CVE Program
  28. High 8.8

    CVE-2026-105436 · Mainwp Child (WordPress plugin)

    WordPress MainWP Child plugin <= 6.2.1 - Deserialization of untrusted data vulnerability

    Published 8 Oct 2026 · CVE Program
  29. Medium 6.5

    CVE-2026-27420 · Zotpress (WordPress plugin)

    WordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (XSS) vulnerability

    Published 8 Oct 2026 · CVE Program
  30. Medium 5.3

    CVE-2026-42698 · Tutor (WordPress plugin)

    WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability

    Published 8 Oct 2026 · CVE Program
  31. Medium 6.5

    CVE-2026-62127 · WP Plugin Info Card (WordPress plugin)

    WordPress WP plugin Info Card plugin <= 6.3.5 - Cross Site Scripting (XSS) vulnerability

    Published 8 Oct 2026 · CVE Program
  32. Medium 5.3

    CVE-2026-62128 · Creatorlms (WordPress plugin)

    WordPress Creator LMS plugin <= 1.2.21 - Broken Access Control vulnerability

    Published 8 Oct 2026 · CVE Program
  33. High 7.1

    CVE-2026-106611 · Forminator (WordPress plugin)

    WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability

    Published 8 Oct 2026 · CVE Program
  34. Medium 5.3

    CVE-2026-105893 · Event Tickets (WordPress plugin)

    WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability

    Published 8 Oct 2026 · CVE Program
  35. Medium 6.5

    CVE-2026-105079 · Masterstudy Lms Learning Management System (WordPress plugin)

    WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerability

    Published 8 Oct 2026 · CVE Program
  36. Medium 4.3

    CVE-2026-105891 · Event Tickets (WordPress plugin)

    WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability

    Published 8 Oct 2026 · CVE Program
  37. Medium 4.3

    CVE-2026-103072 · Villatheme Core (WordPress plugin)

    WordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability

    Published 8 Oct 2026 · CVE Program
  38. Medium 6.5

    CVE-2026-105890 · Kadence Blocks (WordPress plugin)

    WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability

    Published 8 Oct 2026 · CVE Program
  39. Medium 5.4

    CVE-2026-105888 · Event Tickets (WordPress plugin)

    WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability

    Published 8 Oct 2026 · CVE Program
  40. Medium 6.5

    CVE-2026-105078 · WP Store Locator (WordPress plugin)

    WordPress WP Store Locator plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability

    Published 8 Oct 2026 · CVE Program
  41. Medium 5.3

    CVE-2026-106596 · Visualcomposer (WordPress plugin)

    WordPress Visual Composer Website Builder plugin <= 45.16.3 - Broken Access Control vulnerability

    Published 8 Oct 2026 · CVE Program
  42. Medium 6.5

    CVE-2026-105887 · Robo Gallery (WordPress plugin)

    WordPress Robo Gallery plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability

    Published 8 Oct 2026 · CVE Program
  43. Medium 6.5

    CVE-2026-103070 · Shortpixel Image Optimiser (WordPress plugin)

    WordPress ShortPixel Image Optimizer plugin <= 6.5.6 - Cross Site Scripting (XSS) vulnerability

    Published 8 Oct 2026 · CVE Program
  44. Medium 6.5

    CVE-2026-105886 · Ultimate Post Kit (WordPress plugin)

    WordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerability

    Published 8 Oct 2026 · CVE Program
  45. High 7.6

    CVE-2026-105076 · Vitepos Lite (WordPress plugin)

    WordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability

    Published 8 Oct 2026 · CVE Program
  46. High 8.8

    CVE-2026-62142 · WP 2fa (WordPress plugin)

    WordPress WP 2FA plugin <= 4.1.0 - Cross Site Request Forgery (CSRF) vulnerability

    Published 8 Oct 2026 · CVE Program
  47. Medium 5.3

    CVE-2026-105878 · Yith Woocommerce Product Bundles (WordPress plugin)

    WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability

    Published 8 Oct 2026 · CVE Program
  48. Medium 6.5

    CVE-2026-106603 · Holler Box (WordPress plugin)

    WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability

    Published 8 Oct 2026 · CVE Program
  49. High 7.1

    CVE-2026-66479 · Wpcomplete (WordPress plugin)

    WordPress WPComplete plugin <= 2.9.5.6 - CSRF to Stored XSS vulnerability

    Published 8 Oct 2026 · CVE Program
  50. Medium 5.3

    CVE-2026-106600 · Give (WordPress plugin)

    WordPress GiveWP plugin <= 4.18.0 - Broken Access Control vulnerability

    Published 8 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.