UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 6.5

    CVE-2026-102914 · Presto Player (WordPress plugin)

    WordPress Presto Player plugin <= 4.5.2 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program
  2. Medium 4.3

    CVE-2026-104675 · Event Tickets (WordPress plugin)

    WordPress Event Tickets plugin <= 5.30.0 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  3. Medium 6.5

    CVE-2026-103084 · Premium Addons For Elementor (WordPress plugin)

    WordPress Premium Addons for Elementor plugin <= 4.11.109 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program
  4. Medium 5.3

    CVE-2026-104397 · Name Directory (WordPress plugin)

    WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability

    Published 5 Oct 2026 · CVE Program
  5. Medium 6.5

    CVE-2026-105060 · Logo Showcase (WordPress plugin)

    WordPress Logo Showcase plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program
  6. Medium 6.5

    CVE-2026-104673 · Mp3 Music Player By Sonaar (WordPress plugin)

    WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.14.2 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program
  7. Medium 6.5

    CVE-2026-105056 · Ecommerce Product Catalog (WordPress plugin)

    WordPress eCommerce Product Catalog plugin <= 3.6.2 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program
  8. High 7.6

    CVE-2026-104408 · Groundhogg (WordPress plugin)

    WordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerability

    Published 5 Oct 2026 · CVE Program
  9. Medium 5.3

    CVE-2026-103335 · Video Conferencing With Zoom API (WordPress plugin)

    WordPress Video Conferencing with Zoom plugin <= 4.6.10 - Sensitive Data Exposure vulnerability

    Published 5 Oct 2026 · CVE Program
  10. Medium 5.3

    CVE-2026-105055 · WP Mailster (WordPress plugin)

    WordPress WP Mailster plugin <= 1.9.0.0 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  11. Medium 5.3

    CVE-2026-97071 · Woo Multi Currency (WordPress plugin)

    WordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  12. Medium 4.3

    CVE-2026-105062 · WP Admin Audit (WordPress plugin)

    WordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  13. Medium 4.3

    CVE-2026-103078 · JS Support Ticket (WordPress plugin)

    WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability

    Published 5 Oct 2026 · CVE Program
  14. High 7.1

    CVE-2026-104407 · Powerpress (WordPress plugin)

    WordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Site Request Forgery (CSRF) vulnerability

    Published 5 Oct 2026 · CVE Program
  15. Medium 6.5

    CVE-2026-104386 · Wpvr (WordPress plugin)

    WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability

    Published 5 Oct 2026 · CVE Program
  16. Medium 6.5

    CVE-2026-105069 · Qr Redirector (WordPress plugin)

    WordPress QR Redirector plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program
  17. Medium 6.5

    CVE-2026-104404 · Give (WordPress plugin)

    WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program
  18. Medium 5.3

    CVE-2026-105068 · Events Manager (WordPress plugin)

    WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability

    Published 5 Oct 2026 · CVE Program
  19. Medium 4.3

    CVE-2026-104401 · Memberful WP (WordPress plugin)

    WordPress Memberful - Membership Plugin plugin <= 1.81.2 - Sensitive Data Exposure vulnerability

    Published 5 Oct 2026 · CVE Program
  20. Medium 6.5

    CVE-2026-104400 · B Blocks (WordPress plugin)

    WordPress B Blocks plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program
  21. Medium 6.5

    CVE-2026-104409 · Final Tiles Grid Gallery Lite (WordPress plugin)

    WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.13 - Cross Site Scripting (XSS) vulnerability

    Published 5 Oct 2026 · CVE Program
  22. Medium 4.3

    CVE-2026-104402 · Mindio Magic Mcp (WordPress plugin)

    WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability

    Published 4 Oct 2026 · CVE Program
  23. High 7.5

    CVE-2026-97307 · Cost Calculator Builder (WordPress plugin)

    WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability

    Published 4 Oct 2026 · CVE Program
  24. Critical 9.3

    CVE-2026-103355 · Unlimited Elements For Elementor (WordPress plugin)

    WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

    Published 4 Oct 2026 · CVE Program
  25. High 7.1

    CVE-2026-103344 · Unlimited Elements For Elementor (WordPress plugin)

    WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability

    Published 4 Oct 2026 · CVE Program
  26. High 7.1

    CVE-2026-97276 · WP Statistics (WordPress plugin)

    WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability

    Published 4 Oct 2026 · CVE Program
  27. High 7.1

    CVE-2026-103354 · Kadence Blocks (WordPress plugin)

    WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability

    Published 4 Oct 2026 · CVE Program
  28. Unrated

    CVE-2026-94239 · Loco Translate (WordPress plugin)

    Loco Translate: Cross-site Scripting

    Published 3 Oct 2026 · Fixed in 2.8.9 · WPVulnerability
  29. Unrated

    CVE-2026-94238 · Loco Translate (WordPress plugin)

    Loco Translate: Path Traversal

    Published 3 Oct 2026 · Fixed in 2.8.9 · WPVulnerability
  30. High 7.2

    CVE-2026-96564 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 2 Oct 2026 · Fixed in 10.3 · WPVulnerability
  31. Medium 6.4

    CVE-2026-116535 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 2 Oct 2026 · Fixed in 10.4 · CVE Program, WPVulnerability
  32. High 7.2

    CVE-2026-107768 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Cross-site Scripting

    Published 2 Oct 2026 · Fixed in 3.3.8 · CVE Program, WPVulnerability
  33. Medium 4.9

    CVE-2026-101357 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 2 Oct 2026 · Fixed in 10.3 · WPVulnerability
  34. High 7.5

    CVE-2026-100517 · Woo Photo Reviews (WordPress plugin)

    WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability

    Published 1 Oct 2026 · CVE Program
  35. High 7.5

    CVE-2026-85081 · Filester (WordPress plugin)

    File Manager Pro – Filester: Cross-site Scripting

    Published 26 Sept 2026 · Fixed in 2.1.3 · WPVulnerability
  36. Medium 6.5

    CVE-2026-84744 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Code Injection

    Published 24 Sept 2026 · Fixed in 2.0.2.1 · WPVulnerability
  37. Unrated

    CVE-2026-74991 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Improper Access Control

    Published 24 Sept 2026 · Fixed in 2.0.2 · WPVulnerability
  38. Medium 4.7

    CVE-2026-101921 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 24 Sept 2026 · Fixed in 2.0.2.2 · CVE Program, WPVulnerability
  39. High 8.1Actively exploited

    CVE-2026-87902 · WordPress

    Unauthenticated path traversal in page-template resolution leading to conditional RCE

    Published 22 Sept 2026 · Fixed in 6.9.9, 7.0.6, 7.1.2 · NVD, WordPress
  40. High 7.1

    CVE-2026-103062 · Translatepress Multilingual (WordPress plugin)

    Vulnerability in TranslatePress – Translate Multilingual sites with AI Translation

    Published 21 Sept 2026 · Fixed in 3.3.7 · CVE Program, WPVulnerability
  41. Unrated

    CVE-2026-92403 · Secure Custom Fields (WordPress plugin)

    Secure Custom Fields: Incorrect Authorization

    Published 19 Sept 2026 · Fixed in 6.9.4 · WPVulnerability
  42. Low 1.8

    GHSA-rmpv-w5v9-rqh5 · WordPress

    HTML API: `set_modifiable_text()` allows breaking out of a comment via abrupt-closing sequences

    Published 18 Sept 2026 · Fixed in 6.8.9, 6.9.8, 7.0.5 · WordPress
  43. Medium 5.3

    GHSA-76jg-r2qr-v77f · WordPress

    Site Administrator can network-activate an installed Network-only plugin

    Published 18 Sept 2026 · Fixed in 6.8.9, 6.9.8, 7.0.5 · WordPress
  44. Medium 5.3

    GHSA-5qf7-2r5p-ppj8 · WordPress

    Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org

    Published 18 Sept 2026 · Fixed in 6.8.9, 6.9.8, 7.0.5 · WordPress
  45. Low

    GHSA-mgvw-845h-9qgq · WordPress

    A theme that supports custom-header and does not register an admin-preview-callback is vulnerable to stored XSS

    Published 18 Sept 2026 · Fixed in 6.8.9, 6.9.8, 7.0.5 · WordPress
  46. Medium

    GHSA-xhp5-863h-rhfr · WordPress

    XML-RPC can be used to publish `customize_changeset` posts that bypass checks for `edit_css`

    Published 18 Sept 2026 · Fixed in 6.9.8, 7.0.5, 7.1.1 · WordPress
  47. Medium 4.3

    GHSA-w57f-v787-qhpf · WordPress

    Authenticated Path Traversal in WP REST Templates Controller

    Published 18 Sept 2026 · Fixed in 6.9.8, 7.0.5, 7.1.1 · WordPress
  48. High

    GHSA-qg7r-fjh2-wvx8 · WordPress

    Stored cross-site scripting in `wpautop()` allows an unauthenticated visitor to inject script

    Published 18 Sept 2026 · Fixed in 6.9.8, 7.0.5, 7.1.1 · WordPress
  49. Low

    GHSA-f522-h982-63mg · WordPress

    Missing Authorization leads to Draft/Pending Post Slug Disclosure by Contributor+

    Published 18 Sept 2026 · Fixed in 6.9.8, 7.0.5, 7.1.1 · WordPress
  50. Medium 5.3

    GHSA-cjfg-q57r-mq45 · WordPress

    Missing `read_post` check in `attachment_submitbox_metadata()` leaks a private parent-post title

    Published 18 Sept 2026 · Fixed in 6.9.8, 7.0.5, 7.1.1 · WordPress

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.