UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 7.2

    CVE-2026-75962 · Post Smtp (WordPress plugin)

    Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)

    Published 6 Oct 2026 · CVE Program
  2. Medium 6.5

    CVE-2026-97300 · WP Event Solution (WordPress plugin)

    WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  3. High 7.5

    CVE-2026-41563 · Sitemovr (WordPress plugin)

    WordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability

    Published 6 Oct 2026 · CVE Program
  4. High 7.5

    CVE-2026-41558 · Wpsynchro (WordPress plugin)

    WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability

    Published 6 Oct 2026 · CVE Program
  5. High 7.5

    CVE-2026-39789 · Fluent Affiliate Pro (WordPress plugin)

    WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  6. High 7.1

    CVE-2026-39760 · Real3d Flipbook Lite (WordPress plugin)

    WordPress Real 3D FlipBook plugin <= 5.5 - Cross Site Scripting (XSS) vulnerability

    Published 6 Oct 2026 · CVE Program
  7. High 7.5

    CVE-2026-39723 · Wc Gateway Greeninvoice (WordPress plugin)

    WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  8. Medium 4.3

    CVE-2026-39599 · Wds Mcp Content Manager (WordPress plugin)

    WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  9. Medium 6.5

    CVE-2026-32582 · Iato Mcp (WordPress plugin)

    WordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability

    Published 6 Oct 2026 · CVE Program
  10. Medium 6.5

    CVE-2026-32576 · Woorechnung (WordPress plugin)

    WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability

    Published 6 Oct 2026 · CVE Program
  11. High 7.5

    CVE-2026-105072 · Fluent Booking Pro (WordPress plugin)

    WordPress FluentBooking Pro plugin < 2.5.0 - Broken Access Control vulnerability

    Published 6 Oct 2026 · Fixed in 2.5.0 · CVE Program
  12. High 8.5

    CVE-2026-103066 · WP Base Booking Of Appointments Services And Events (WordPress plugin)

    WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability

    Published 5 Oct 2026 · CVE Program
  13. High 7.2

    CVE-2026-100506 · WP Spell Check (WordPress plugin)

    WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability

    Published 5 Oct 2026 · CVE Program
  14. High 8.8

    CVE-2026-100511 · Vk Google Job Posting Manager (WordPress plugin)

    WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability

    Published 5 Oct 2026 · CVE Program
  15. High 8.8

    CVE-2026-97257 · Simple Event Planner (WordPress plugin)

    WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability

    Published 5 Oct 2026 · CVE Program
  16. High 7.2

    CVE-2026-93617 · Sunshine Photo Cart (WordPress plugin)

    WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability

    Published 5 Oct 2026 · CVE Program
  17. High 7.2

    CVE-2026-103348 · WP Ultimate Exporter (WordPress plugin)

    WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability

    Published 5 Oct 2026 · CVE Program
  18. Medium 6.5

    CVE-2026-103337 · Wc Ukr Shipping (WordPress plugin)

    WordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  19. High 7.2

    CVE-2026-103349 · Woo Product Feed Pro (WordPress plugin)

    WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability

    Published 5 Oct 2026 · CVE Program
  20. High 7.6

    CVE-2026-97303 · Scratch Win Giveaways For Website Facebook (WordPress plugin)

    WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  21. Critical 9.3

    CVE-2026-103352 · WP Base Booking Of Appointments Services And Events (WordPress plugin)

    WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability

    Published 5 Oct 2026 · CVE Program
  22. Critical 9.8

    CVE-2026-97283 · Advanced Post Manager (WordPress plugin)

    WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

    Published 5 Oct 2026 · CVE Program
  23. Medium 5.3

    CVE-2026-97275 · Woo Product Builder (WordPress plugin)

    WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability

    Published 5 Oct 2026 · CVE Program
  24. High 7.1

    CVE-2026-97309 · Computer Repair Shop (WordPress plugin)

    WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability

    Published 5 Oct 2026 · CVE Program
  25. Medium 6.9

    CVE-2026-97070 · Cozy Addons (WordPress plugin)

    WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability

    Published 5 Oct 2026 · CVE Program
  26. Medium 6.9

    CVE-2026-97305 · Hyve Lite (WordPress plugin)

    WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

    Published 5 Oct 2026 · CVE Program
  27. High 7.5

    CVE-2026-103334 · Restaurant Reservations (WordPress plugin)

    WordPress Five Star Restaurant Reservations plugin <= 2.7.24 - Sensitive Data Exposure vulnerability

    Published 5 Oct 2026 · CVE Program
  28. Medium 6.5

    CVE-2026-97304 · Timetics (WordPress plugin)

    WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  29. High 7.1

    CVE-2026-100515 · Woo Photo Reviews (WordPress plugin)

    WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program
  30. Medium 6.5

    CVE-2026-103085 · WP User Manager (WordPress plugin)

    WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability

    Published 5 Oct 2026 · CVE Program
  31. Medium 6.5

    CVE-2026-103086 · Userswp (WordPress plugin)

    WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  32. Medium 6.5

    CVE-2026-100509 · Computer Repair Shop (WordPress plugin)

    WordPress RepairBuddy plugin <= 4.1225 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program
  33. Medium 6.5

    CVE-2026-102383 · Woo Lookbook (WordPress plugin)

    WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  34. High 7.1

    CVE-2025-15643 · Adsensei B30 (WordPress plugin)

    WordPress Adsmonetizer plugin <= 3.2.4 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program
  35. Medium 6.5

    CVE-2026-42700 · Image Slider Widget (WordPress plugin)

    WordPress Image Slider Widget plugin <= 1.1.130 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program
  36. Medium 5.1

    CVE-2026-105397 · Learnpress (WordPress plugin)

    LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation

    Published 5 Oct 2026 · CVE Program
  37. Medium 5.3

    CVE-2026-105421 · Convertkit For Woocommerce (WordPress plugin)

    WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  38. Medium 4.3

    CVE-2026-39783 · Polylang (WordPress plugin)

    WordPress Polylang plugin <= 3.8.7 - Sensitive Data Exposure vulnerability

    Published 5 Oct 2026 · CVE Program
  39. Medium 5.3

    CVE-2026-103684 · WP Event Solution (WordPress plugin)

    WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  40. Medium 5.3

    CVE-2026-105073 · WP Event Solution (WordPress plugin)

    WordPress WP Event Solution plugin <= 4.1.25 - Sensitive Data Exposure vulnerability

    Published 5 Oct 2026 · CVE Program
  41. Medium 5.3

    CVE-2026-94669 · Fluentformpro (WordPress plugin)

    WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  42. Medium 4.3

    CVE-2026-39763 · WP Dummy Content Generator (WordPress plugin)

    WordPress WP Dummy Content Generator plugin <= 4.0.0 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  43. Medium 5.4

    CVE-2026-39721 · Astra Sites (WordPress plugin)

    WordPress Starter Templates plugin <= 4.7.7 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  44. Medium 6.5

    CVE-2026-105064 · Unlimited Elements For Elementor (WordPress plugin)

    WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.22 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  45. Medium 5.3

    CVE-2026-103351 · Ecab Taxi Booking Manager (WordPress plugin)

    WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.1 - Other vulnerability Type vulnerability

    Published 5 Oct 2026 · CVE Program
  46. High 8.5

    CVE-2026-104389 · Sirv (WordPress plugin)

    WordPress Sirv plugin <= 8.2.5 - SQL Injection vulnerability

    Published 5 Oct 2026 · CVE Program
  47. Medium 5.3

    CVE-2026-104388 · Powerpress (WordPress plugin)

    WordPress PowerPress Podcasting plugin <= 11.17.9 - Sensitive Data Exposure vulnerability

    Published 5 Oct 2026 · CVE Program
  48. Medium 6.5

    CVE-2026-102393 · Astra Sites (WordPress plugin)

    WordPress Starter Templates plugin <= 4.7.7 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program
  49. Medium 5.4

    CVE-2026-103079 · JS Support Ticket (WordPress plugin)

    WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability

    Published 5 Oct 2026 · CVE Program
  50. Medium 6.5

    CVE-2026-104396 · Name Directory (WordPress plugin)

    WordPress Name Directory plugin <= 1.34.2 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.