UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 4.8

    CVE-2026-97308 · Login Lockdown (WordPress plugin)

    WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability

    Published 6 Oct 2026 · CVE Program
  2. High 8.1

    CVE-2026-95594 · SMS Alert (WordPress plugin)

    WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability

    Published 6 Oct 2026 · CVE Program
  3. High 7.3

    CVE-2026-95526 · Woo Bulk Editor (WordPress plugin)

    WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  4. High 7.1

    CVE-2026-94675 · Fluentformpro (WordPress plugin)

    WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  5. High 7.5

    CVE-2026-66588 · Dt The7 (WordPress theme)

    WordPress The7 theme <= 14.2.2 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  6. High 8.8

    CVE-2026-62072 · Progress Planner (WordPress plugin)

    WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  7. High 7.5

    CVE-2026-48199 · Sermone (WordPress plugin)

    WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  8. High 7.2

    CVE-2026-48197 · Capability Manager Enhanced (WordPress plugin)

    WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

    Published 6 Oct 2026 · CVE Program
  9. High 7.5

    CVE-2026-42638 · Easy Digital Downloads (WordPress plugin)

    WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  10. Medium 6.5

    CVE-2026-42637 · Payplug (WordPress plugin)

    WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability

    Published 6 Oct 2026 · CVE Program
  11. High 7.1

    CVE-2026-42636 · Gdpr Cookie Consent (WordPress plugin)

    WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  12. High 7.1

    CVE-2026-42635 · Woocommerce Simple Auctions (WordPress plugin)

    WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  13. High 7.1

    CVE-2026-42634 · Video Background Block (WordPress plugin)

    WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  14. High 7.1

    CVE-2026-42418 · Social Rocket (WordPress plugin)

    WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  15. Critical 9.3

    CVE-2026-42417 · Armember (WordPress plugin)

    WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  16. High 8.5

    CVE-2026-42416 · U Design Core (WordPress plugin)

    WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  17. Critical 9.3

    CVE-2026-42415 · Porto Functionality (WordPress plugin)

    WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  18. High 8.5

    CVE-2026-42414 · Listingpro Plugin (WordPress plugin)

    WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  19. High 7.5

    CVE-2026-42413 · Snapshotify (WordPress plugin)

    WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability

    Published 6 Oct 2026 · CVE Program
  20. High 7.5

    CVE-2026-41562 · Norvis Backup (WordPress plugin)

    WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

    Published 6 Oct 2026 · CVE Program
  21. High 7.5

    CVE-2026-41561 · Museder Restoreone (WordPress plugin)

    WordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability

    Published 6 Oct 2026 · CVE Program
  22. High 7.5

    CVE-2026-41560 · Wxd Backup Lite (WordPress plugin)

    WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  23. High 7.5

    CVE-2026-41559 · Safesnap (WordPress plugin)

    WordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerability

    Published 6 Oct 2026 · CVE Program
  24. Critical 9.3

    CVE-2026-41555 · Newsletter Subscription Form (WordPress plugin)

    WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  25. High 7.1

    CVE-2026-40807 · Cf7 Views (WordPress plugin)

    WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  26. High 7.1

    CVE-2026-40806 · Blog Posts And Category For Elementor (WordPress plugin)

    WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  27. Medium 6.5

    CVE-2026-39798 · Truebooker Appointment Booking (WordPress plugin)

    WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability

    Published 6 Oct 2026 · CVE Program
  28. Critical 9.8

    CVE-2026-39797 · Gdpr Framework (WordPress plugin)

    WordPress GDPR Framework By Data443 plugin <= 2.5.0 - PHP Object Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  29. High 7.5

    CVE-2026-39796 · Advanced Posts Listing (WordPress plugin)

    WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  30. Critical 9.3

    CVE-2026-39795 · Sendpress (WordPress plugin)

    WordPress SendPress Newsletters plugin <= 1.26.1.20 - SQL Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  31. High 7.5

    CVE-2026-39794 · Wcfm Marketplace Rest API (WordPress plugin)

    WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  32. High 8.8

    CVE-2026-39793 · Simple Jwt Login (WordPress plugin)

    WordPress Simple JWT Login plugin 4.0.0 - Broken Authentication vulnerability

    Published 6 Oct 2026 · CVE Program
  33. High 8.6

    CVE-2026-39792 · Simple File List (WordPress plugin)

    WordPress Simple File List plugin <= 6.3.11 - Arbitrary File Deletion vulnerability

    Published 6 Oct 2026 · CVE Program
  34. Medium 5.3

    CVE-2026-39791 · Mailjet For Wordpress (WordPress plugin)

    WordPress Mailjet Email Marketing plugin <= 6.2.3 - Sensitive Data Exposure vulnerability

    Published 6 Oct 2026 · CVE Program
  35. High 7.1

    CVE-2026-39790 · Vikrentcar (WordPress plugin)

    WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  36. Medium 6.5

    CVE-2026-39788 · Front End Pm (WordPress plugin)

    WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  37. Medium 6.5

    CVE-2026-39787 · Wd Instagram Feed (WordPress plugin)

    WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  38. Critical 9.3

    CVE-2026-39785 · Grand Media (WordPress plugin)

    WordPress Gmedia Photo Gallery plugin <= 1.25.1 - SQL Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  39. High 7.1

    CVE-2026-39784 · Nd Booking (WordPress plugin)

    WordPress Hotel Booking plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  40. High 7.1

    CVE-2026-39781 · Document Gallery (WordPress plugin)

    WordPress Document Gallery plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  41. High 7.1

    CVE-2026-39780 · Youzify (WordPress plugin)

    WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  42. High 7.1

    CVE-2026-39778 · Ansar Import (WordPress plugin)

    WordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  43. High 8.0

    CVE-2026-39776 · Tabs Responsive (WordPress plugin)

    WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability

    Published 6 Oct 2026 · CVE Program
  44. High 8.8

    CVE-2026-39775 · Jobzilla (WordPress theme)

    WordPress JobZilla - Job Board WordPress Theme theme <= 2.2 - Privilege Escalation vulnerability

    Published 6 Oct 2026 · CVE Program
  45. High 8.8

    CVE-2026-39774 · Tourfic Pro (WordPress plugin)

    WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability

    Published 6 Oct 2026 · CVE Program
  46. Critical 10.0

    CVE-2026-39773 · Doctreat Core (WordPress plugin)

    WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability

    Published 6 Oct 2026 · CVE Program
  47. Medium 5.3

    CVE-2026-39772 · Captcha Bws (WordPress plugin)

    WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability

    Published 6 Oct 2026 · CVE Program
  48. High 8.5

    CVE-2026-39771 · Buddyboss Platform (WordPress plugin)

    WordPress Buddyboss Platform plugin <= 3.1.0 - SQL Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  49. Critical 10.0

    CVE-2026-39770 · Doctreat (WordPress theme)

    WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability

    Published 6 Oct 2026 · CVE Program
  50. High 7.5

    CVE-2026-39769 · Graphina Elementor Charts And Graphs (WordPress plugin)

    WordPress Graphina plugin <= 3.1.12 - Broken Authentication vulnerability

    Published 6 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.