UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 7.1

    CVE-2026-39768 · Security Malware Firewall (WordPress plugin)

    WordPress Security & Malware scan by CleanTalk plugin <= 2.189 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  2. Medium 6.5

    CVE-2026-39767 · Wpbase Cache (WordPress plugin)

    WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability

    Published 6 Oct 2026 · CVE Program
  3. High 7.1

    CVE-2026-39766 · Arforms (WordPress plugin)

    WordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  4. High 7.2

    CVE-2026-39765 · Webappick PDF Invoice For Woocommerce (WordPress plugin)

    WordPress Challan plugin <= 3.7.88 - Privilege Escalation vulnerability

    Published 6 Oct 2026 · CVE Program
  5. Critical 9.3

    CVE-2026-39764 · Radius Booking (WordPress plugin)

    WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.19 - SQL Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  6. Medium 6.5

    CVE-2026-39762 · Autoship Cloud (WordPress plugin)

    WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  7. Critical 9.8

    CVE-2026-39761 · Meta Box Aio (WordPress plugin)

    WordPress Meta Box AIO plugin <= 3.7.1 - Privilege Escalation vulnerability

    Published 6 Oct 2026 · CVE Program
  8. Critical 9.9

    CVE-2026-39759 · Workreap Core (WordPress plugin)

    WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability

    Published 6 Oct 2026 · CVE Program
  9. High 7.1

    CVE-2026-39758 · Midtrans Woocommerce (WordPress plugin)

    WordPress Midtrans-WooCommerce plugin <= 2.32.3 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  10. Critical 9.9

    CVE-2026-39757 · Taskbot (WordPress plugin)

    WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability

    Published 6 Oct 2026 · CVE Program
  11. Medium 6.5

    CVE-2026-39756 · Wappointment (WordPress plugin)

    WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability

    Published 6 Oct 2026 · CVE Program
  12. Critical 9.9

    CVE-2026-39755 · Local Sync (WordPress plugin)

    WordPress WP Duplicate plugin <= 1.1.11 - Arbitrary File Upload vulnerability

    Published 6 Oct 2026 · CVE Program
  13. Medium 6.5

    CVE-2026-39754 · Piotnet Addons For Elementor (WordPress plugin)

    WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability

    Published 6 Oct 2026 · CVE Program
  14. Critical 9.8

    CVE-2026-39753 · Taskbot (WordPress plugin)

    WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability

    Published 6 Oct 2026 · CVE Program
  15. High 7.7

    CVE-2026-39752 · Job Postings (WordPress plugin)

    WordPress Jobs for WordPress plugin <= 2.8.2 - Arbitrary File Deletion vulnerability

    Published 6 Oct 2026 · CVE Program
  16. High 7.5

    CVE-2026-39751 · Payplug (WordPress plugin)

    WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  17. High 7.1

    CVE-2026-39750 · Storegrowth Sales Booster (WordPress plugin)

    WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  18. Medium 6.5

    CVE-2026-39749 · App For Cf (WordPress plugin)

    WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  19. High 7.1

    CVE-2026-39748 · Edumall (WordPress theme)

    WordPress EduMall theme <= 4.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  20. High 8.5

    CVE-2026-39747 · Woffice (WordPress plugin), Woffice (WordPress theme)

    WordPress Woffice theme < 5.4.43 - SQL Injection vulnerability

    Published 6 Oct 2026 · Fixed in 5.4.43 · CVE Program
  21. Critical 9.3

    CVE-2026-39746 · Booknetic (WordPress plugin)

    WordPress Booknetic plugin < 5.10.3 - SQL Injection vulnerability

    Published 6 Oct 2026 · Fixed in 5.10.3 · CVE Program
  22. High 7.1

    CVE-2026-39745 · Contact Form To Db (WordPress plugin)

    WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  23. High 7.1

    CVE-2026-39731 · Database For Cf7 (WordPress plugin)

    WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  24. High 7.1

    CVE-2026-39730 · Wise Chat (WordPress plugin)

    WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  25. High 7.2

    CVE-2026-39729 · Edwiser Bridge (WordPress plugin)

    WordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability

    Published 6 Oct 2026 · CVE Program
  26. High 7.2

    CVE-2026-39728 · Instapage (WordPress plugin)

    WordPress Instapage Plugin plugin <= 3.7.2 - Server Side Request Forgery (SSRF) vulnerability

    Published 6 Oct 2026 · CVE Program
  27. Medium 6.5

    CVE-2026-39727 · Wc Fields Factory (WordPress plugin)

    WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  28. High 7.1

    CVE-2026-39726 · Lumise (WordPress plugin)

    WordPress Lumise Product Designer plugin < 2.1.4.1 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · Fixed in 2.1.4.1 · CVE Program
  29. High 8.8

    CVE-2026-39725 · Content Visibility For Divi Builder (WordPress plugin)

    WordPress Content Visibility for Divi Builder plugin <= 5.03 - Remote Code Execution (RCE) vulnerability

    Published 6 Oct 2026 · CVE Program
  30. High 7.1

    CVE-2026-39724 · Http Requests Manager (WordPress plugin)

    WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  31. High 7.1

    CVE-2026-39722 · Wplms (WordPress theme)

    WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  32. High 7.1

    CVE-2026-39720 · Mapster WP Maps (WordPress plugin)

    WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  33. High 7.2

    CVE-2026-39719 · PDF Smart Viewer For Elementor (WordPress plugin)

    WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability

    Published 6 Oct 2026 · CVE Program
  34. High 7.1

    CVE-2026-32581 · Mooberry Book Manager (WordPress plugin)

    WordPress Mooberry Book Manager plugin 4.16.2 - SQL Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  35. High 7.5

    CVE-2026-32580 · Wc Lottery (WordPress plugin)

    WordPress WooCommerce Lottery plugin <= 2.2.9 - SQL Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  36. Critical 10.0

    CVE-2026-32579 · Chatbot Chatgpt (WordPress plugin)

    WordPress Kognetiks Chatbot for WordPress plugin <= 2.4.9 - Arbitrary File Upload vulnerability

    Published 6 Oct 2026 · CVE Program
  37. High 7.1

    CVE-2026-32578 · Ecpay Ecommerce For Woocommerce (WordPress plugin)

    WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  38. High 7.1

    CVE-2026-32577 · Nmedia User File Uploader (WordPress plugin)

    WordPress Frontend File Manager plugin <= 23.6 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  39. High 7.1

    CVE-2026-32575 · Affs (WordPress plugin)

    WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  40. High 7.1

    CVE-2026-32574 · Smart Forms (WordPress plugin)

    WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  41. High 7.1

    CVE-2026-32572 · WP User Frontend Pro (WordPress plugin)

    WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  42. Medium 6.5

    CVE-2026-32571 · Ohio Extra (WordPress plugin)

    WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  43. High 7.1

    CVE-2026-32570 · Daftplug Progressify (WordPress plugin)

    WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  44. High 7.1

    CVE-2026-32569 · WP Media Folder (WordPress plugin)

    WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  45. Critical 9.9

    CVE-2026-32568 · Wc Designer Pro (WordPress plugin)

    WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability

    Published 6 Oct 2026 · CVE Program
  46. Critical 9.3

    CVE-2026-32557 · Woocommerce Appointments (WordPress plugin)

    WordPress WooCommerce Appointments plugin <= 5.3.2 - SQL Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  47. High 8.5

    CVE-2026-25434 · Wp2leads (WordPress plugin)

    WordPress WP2LEADS plugin <= 3.5.7 - SQL Injection vulnerability

    Published 6 Oct 2026 · CVE Program
  48. High 7.1

    CVE-2026-25433 · Wp2leads (WordPress plugin)

    WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  49. Medium 6.5

    CVE-2026-105879 · Jet Elements (WordPress plugin)

    WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  50. High 7.1

    CVE-2026-103346 · Payflex Payment Gateway (WordPress plugin)

    WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.