UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 7.1

    CVE-2026-114178 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 8 Oct 2026 · Fixed in 2.11.0 · CVE Program, WPVulnerability
  2. Unrated

    CVE-2026-104751 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 8 Oct 2026 · Fixed in 1.0.280 · WPVulnerability
  3. High 7.5

    CVE-2026-96335 · Forminator (WordPress plugin)

    WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability

    Published 7 Oct 2026 · CVE Program
  4. Critical 9.8

    CVE-2026-95606 · The Events Calendar (WordPress plugin)

    WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability

    Published 7 Oct 2026 · CVE Program
  5. Critical 9.3

    CVE-2026-95605 · WP Data Access (WordPress plugin)

    WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability

    Published 7 Oct 2026 · CVE Program
  6. High 7.1

    CVE-2026-95595 · Disable Remove Google Fonts (WordPress plugin)

    WordPress Disable and Remove Google Fonts | GDPR & DSGVO friendly plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability

    Published 7 Oct 2026 · CVE Program
  7. High 8.8

    CVE-2026-95534 · Unlimited Elements For Elementor (WordPress plugin)

    WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - PHP Object Injection vulnerability

    Published 7 Oct 2026 · CVE Program
  8. High 7.1

    CVE-2026-94670 · Everest Forms (WordPress plugin)

    WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability

    Published 7 Oct 2026 · CVE Program
  9. High 7.1

    CVE-2026-94662 · Unlimited Elements For Elementor (WordPress plugin)

    WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability

    Published 7 Oct 2026 · CVE Program
  10. High 7.6

    CVE-2026-42708 · WP Post Author (WordPress plugin)

    WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability

    Published 7 Oct 2026 · CVE Program
  11. High 7.6

    CVE-2026-42710 · Slider Wd (WordPress plugin)

    WordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability

    Published 7 Oct 2026 · CVE Program
  12. High 7.6

    CVE-2026-42713 · Post Title Marquee Scroll (WordPress plugin)

    WordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability

    Published 7 Oct 2026 · CVE Program
  13. High 7.6

    CVE-2026-42714 · Pix Por Piggly (WordPress plugin)

    WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability

    Published 7 Oct 2026 · CVE Program
  14. High 7.6

    CVE-2026-42720 · Dynamic User Directory (WordPress plugin)

    WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability

    Published 7 Oct 2026 · CVE Program
  15. High 7.6

    CVE-2026-42721 · Affiliate Toolkit Starter (WordPress plugin)

    WordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability

    Published 7 Oct 2026 · CVE Program
  16. Medium 5.3

    CVE-2026-27434 · Wprentals (WordPress plugin), Wprentals (WordPress theme)

    WordPress WP Rentals theme <= 3.14.2 - Broken Access Control vulnerability

    Published 7 Oct 2026 · CVE Program
  17. Medium 4.3

    CVE-2026-104390 · Booktics (WordPress plugin)

    WordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerability

    Published 7 Oct 2026 · CVE Program
  18. Medium 5.3

    CVE-2026-105876 · Modula Best Grid Gallery (WordPress plugin)

    WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability

    Published 7 Oct 2026 · CVE Program
  19. Medium 6.5

    CVE-2026-104393 · Happy Elementor Addons (WordPress plugin)

    WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerability

    Published 7 Oct 2026 · CVE Program
  20. Medium 6.5

    CVE-2026-105875 · Bdthemes Prime Slider Lite (WordPress plugin)

    WordPress Prime Slider – Addons For Elementor plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability

    Published 7 Oct 2026 · CVE Program
  21. Medium 6.5

    CVE-2026-104391 · Quiz Master Next (WordPress plugin)

    WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability

    Published 7 Oct 2026 · CVE Program
  22. Medium 4.3

    CVE-2026-103075 · Wordpress Popup (WordPress plugin)

    WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability

    Published 7 Oct 2026 · CVE Program
  23. Medium 6.5

    CVE-2026-105884 · Rocket Lazy Load (WordPress plugin)

    WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

    Published 7 Oct 2026 · CVE Program
  24. Medium 6.5

    CVE-2026-105873 · Bdthemes Element Pack Lite (WordPress plugin)

    WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability

    Published 7 Oct 2026 · CVE Program
  25. Medium 6.5

    CVE-2026-97294 · Media Library Assistant (WordPress plugin)

    WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability

    Published 7 Oct 2026 · CVE Program
  26. Medium 6.5

    CVE-2026-105871 · Bdthemes Element Pack Lite (WordPress plugin)

    WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability

    Published 7 Oct 2026 · CVE Program
  27. High 7.2

    CVE-2026-89417 · Host Webfonts Local (WordPress plugin)

    OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed

    Published 7 Oct 2026 · CVE Program
  28. High 7.2

    CVE-2026-102173 · Kirki (WordPress plugin)

    Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata

    Published 7 Oct 2026 · CVE Program
  29. Medium 6.9

    CVE-2026-104399 · Motors Car Dealership Classified Listings (WordPress plugin)

    WordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability

    Published 6 Oct 2026 · CVE Program
  30. High 8.5

    CVE-2026-105317 · Paid Member Subscriptions (WordPress plugin)

    WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  31. High 7.5

    CVE-2026-105071 · Sitevault Backup Restore Migration (WordPress plugin)

    WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.17 - Sensitive Data Exposure vulnerability

    Published 6 Oct 2026 · CVE Program
  32. High 8.8

    CVE-2026-105070 · Salon Booking System (WordPress plugin)

    WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability

    Published 6 Oct 2026 · CVE Program
  33. High 7.1

    CVE-2026-105061 · WP Mailster (WordPress plugin)

    WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  34. Medium 6.5

    CVE-2026-105059 · Delete All Comments Of Website (WordPress plugin)

    WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  35. High 8.8

    CVE-2026-105058 · WP User Profiles (WordPress plugin)

    WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability

    Published 6 Oct 2026 · CVE Program
  36. Medium 5.3

    CVE-2026-105057 · Zero Spam (WordPress plugin)

    WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability

    Published 6 Oct 2026 · CVE Program
  37. High 7.1

    CVE-2026-104814 · Form Block (WordPress plugin)

    WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  38. High 7.2

    CVE-2026-104757 · Import Users From Csv With Meta (WordPress plugin)

    WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability

    Published 6 Oct 2026 · CVE Program
  39. High 8.1

    CVE-2026-104747 · Haaken (WordPress theme)

    WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  40. High 7.1

    CVE-2026-104672 · Give (WordPress plugin)

    WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  41. High 7.1

    CVE-2026-104670 · Learnpress (WordPress plugin)

    WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  42. High 7.3

    CVE-2026-104406 · Picu (WordPress plugin)

    WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  43. High 8.1

    CVE-2026-104405 · Give (WordPress plugin)

    WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability

    Published 6 Oct 2026 · CVE Program
  44. High 7.1

    CVE-2026-104395 · Picu (WordPress plugin)

    WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  45. High 7.1

    CVE-2026-104394 · Charitable (WordPress plugin)

    WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  46. High 7.2

    CVE-2026-104387 · Powerpress (WordPress plugin)

    WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  47. High 7.5

    CVE-2026-104385 · Groundhogg (WordPress plugin)

    WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability

    Published 6 Oct 2026 · CVE Program
  48. High 8.5

    CVE-2026-102915 · Wpo365 Login (WordPress plugin)

    WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  49. High 7.5

    CVE-2026-102387 · Xserver Migrator (WordPress plugin)

    WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability

    Published 6 Oct 2026 · CVE Program
  50. Medium 5.3

    CVE-2026-100518 · Advanced Google Recaptcha (WordPress plugin)

    WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability

    Published 6 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.