UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 6.5

    GHSA-33wf-p63q-w25f · WordPress

    Contributor+ Arbitrary Post Overwrite

    Published 18 Sept 2026 · Fixed in 6.9.8, 7.0.5, 7.1.1 · WordPress
  2. Medium 4.3

    GHSA-32m5-wc28-ghrr · WordPress

    Comments, including notes, can be reparented by any authenticated user

    Published 18 Sept 2026 · Fixed in 6.9.8, 7.0.5, 7.1.1 · WordPress
  3. Medium 6.5

    CVE-2026-112199 · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Published 11 Sept 2026 · Fixed in 4.19.0 · CVE Program, WPVulnerability
  4. High 7.5

    CVE-2026-81799 · Woo Refund And Exchange Lite (WordPress plugin)

    WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability

    Published 10 Sept 2026 · CVE Program
  5. Medium 4.8

    CVE-2026-86604 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Injection

    Published 9 Sept 2026 · Fixed in 5.0.1 · WPVulnerability
  6. High 7.2

    CVE-2026-87920 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-site Scripting

    Published 4 Sept 2026 · Fixed in 2.10.7 · WPVulnerability
  7. Unrated

    CVE-2026-77788 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Authorization Bypass Through User-Controlled Key

    Published 2 Sept 2026 · Fixed in 1.0.277 · WPVulnerability
  8. Unrated

    CVE-2026-77787 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 2 Sept 2026 · Fixed in 1.0.277 · WPVulnerability
  9. Unrated

    CVE-2026-77785 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Authorization Bypass Through User-Controlled Key

    Published 2 Sept 2026 · Fixed in 1.0.277 · WPVulnerability
  10. Unrated

    CVE-2026-77784 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Authorization Bypass Through User-Controlled Key

    Published 2 Sept 2026 · Fixed in 1.0.277 · WPVulnerability
  11. Unrated

    CVE-2026-77783 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Authorization Bypass Through User-Controlled Key

    Published 2 Sept 2026 · Fixed in 1.0.277 · WPVulnerability
  12. Unrated

    CVE-2026-77782 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Exposure of Sensitive Information to an Unauthorized Actor

    Published 2 Sept 2026 · Fixed in 1.0.277.1 · WPVulnerability
  13. Unrated

    WPV-a5c73b8e2e58 · WP Rocket (WordPress plugin)

    Vulnerability in WP Rocket

    Published 28 Aug 2026 · Fixed in 3.23.3.3 · WPVulnerability
  14. High 7.2

    CVE-2026-81757 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Deserialization of Untrusted Data

    Published 28 Aug 2026 · Fixed in 1.0.277 · WPVulnerability
  15. Unrated

    WPV-908926c3f5d2 · WP Rocket (WordPress plugin)

    Vulnerability in WP Rocket

    Published 27 Aug 2026 · Fixed in 3.23.3.3 · WPVulnerability
  16. High 7.2

    CVE-2026-89412 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Cross-site Scripting

    Published 27 Aug 2026 · Fixed in 3.3.6 · WPVulnerability
  17. Unrated

    CVE-2026-77786 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Incorrect Authorization

    Published 27 Aug 2026 · Fixed in 1.0.277 · WPVulnerability
  18. High 7.2

    CVE-2026-76053 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Cross-site Scripting

    Published 25 Aug 2026 · Fixed in 3.3.4 · WPVulnerability
  19. Critical 9.8

    CVE-2026-78267 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Incorrect Privilege Assignment

    Published 24 Aug 2026 · Fixed in 3.3.3 · WPVulnerability
  20. Critical 9.8

    CVE-2026-19632 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Weak Password Recovery Mechanism for Forgotten Password

    Published 24 Aug 2026 · Fixed in 3.3.2 · WPVulnerability
  21. High 7.2

    CVE-2026-78438 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-site Scripting

    Published 21 Aug 2026 · Fixed in 2.10.6 · WPVulnerability
  22. High 7.1

    CVE-2026-66582 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Cross-site Scripting

    Published 20 Aug 2026 · Fixed in 3.3.3 · WPVulnerability
  23. Medium 6.4

    CVE-2026-18512 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Cross-site Scripting

    Published 19 Aug 2026 · Fixed in 3.3 · WPVulnerability
  24. Unrated

    CVE-2026-18051 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Path Traversal

    Published 19 Aug 2026 · Fixed in 2.10.5 · WPVulnerability
  25. Critical 9.8

    CVE-2026-73996 · Learning Management System (WordPress plugin)

    WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

    Published 18 Aug 2026 · CVE Program
  26. Medium 6.4

    CVE-2026-15066 · Loco Translate (WordPress plugin)

    Loco Translate: Cross-site Scripting

    Published 15 Aug 2026 · Fixed in 2.8.8 · WPVulnerability
  27. Medium 6.1

    CVE-2026-15009 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Cross-site Scripting

    Published 15 Aug 2026 · Fixed in 5.4.13 · WPVulnerability
  28. Unrated

    CVE-2026-11565 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Missing Authorization

    Published 15 Aug 2026 · Fixed in 5.4.13 · WPVulnerability
  29. High 7.2

    CVE-2026-18109 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-site Scripting

    Published 13 Aug 2026 · Fixed in 2.10.4 · WPVulnerability
  30. High 8.8

    CVE-2026-65640 · WordPress

    Remote code execution vulnerability via malicious file upload by an Author level user or higher

    Published 12 Aug 2026 · Fixed in 6.8.8, 6.9.7, 7.0.4 · WordPress
  31. High 8.9

    CVE-2026-64638 · WordPress

    Pre-auth reflected XSS on login screen with potential to lead to PHP code execution

    Published 6 Aug 2026 · Fixed in 6.8.7, 6.9.6, 7.0.3 · WordPress
  32. High 7.2

    CVE-2026-75981 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Cross-site Scripting

    Published 5 Aug 2026 · Fixed in 3.2.6 · WPVulnerability
  33. Medium 6.1

    CVE-2026-92554 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 4 Aug 2026 · Fixed in 3.5.2 · WPVulnerability
  34. High 7.2

    CVE-2026-6020 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Unsafe Reflection

    Published 4 Aug 2026 · Fixed in 3.3.8 · WPVulnerability
  35. High 7.2

    CVE-2026-18510 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Cross-site Scripting

    Published 4 Aug 2026 · Fixed in 3.3 · WPVulnerability
  36. Medium 6.1

    CVE-2026-17505 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Cross-site Scripting

    Published 4 Aug 2026 · Fixed in 3.2.6 · WPVulnerability
  37. Medium 6.5

    CVE-2026-95530 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Cross-site Scripting

    Published 31 Jul 2026 · Fixed in 11.4.2 · WPVulnerability
  38. High 7.1

    CVE-2026-66702 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 31 Jul 2026 · Fixed in 1.0.275 · WPVulnerability
  39. Medium 6.5

    CVE-2026-66695 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Path Traversal: '.../...//'

    Published 31 Jul 2026 · Fixed in 2.10.3 · WPVulnerability
  40. Medium 5.3

    CVE-2026-18059 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Exposure of Sensitive Information to an Unauthorized Actor

    Published 31 Jul 2026 · Fixed in 11.2.2 · WPVulnerability
  41. Medium 4.9

    CVE-2026-16811 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: SQL Injection

    Published 27 Jul 2026 · Fixed in 3.4.6 · WPVulnerability
  42. Medium 4.3

    CVE-2026-16797 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Authorization Bypass Through User-Controlled Key

    Published 27 Jul 2026 · Fixed in 3.4.6 · WPVulnerability
  43. Unrated

    CVE-2026-15425 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 24 Jul 2026 · Fixed in 28.1 · WPVulnerability
  44. Critical 9.3

    CVE-2026-61949 · Bookly Responsive Appointment Booking Tool (WordPress plugin)

    WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability

    Published 23 Jul 2026 · CVE Program
  45. Medium 6.1

    CVE-2026-88996 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 20 Jul 2026 · Fixed in 2.0.2.1 · WPVulnerability
  46. Medium 4.9

    CVE-2026-15782 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 20 Jul 2026 · Fixed in 2.0.0.2 · WPVulnerability
  47. Medium 5.9Actively exploited

    CVE-2026-60137 · WordPress

    Facilitated SQL injection vulnerability in the `author__not_in` parameter of `WP_Query`

    Published 17 Jul 2026 · Fixed in 6.8.6, 6.9.5, 7.0.2 · NVD, WordPress
  48. Critical 9.8Actively exploited

    CVE-2026-63030 · WordPress

    REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

    Published 17 Jul 2026 · Fixed in 6.9.5, 7.0.2 · NVD, WordPress
  49. High 8.8

    CVE-2026-15005 · Loco Translate (WordPress plugin)

    Loco Translate: Cross-Site Request Forgery (CSRF)

    Published 15 Jul 2026 · Fixed in 2.8.6 · WPVulnerability
  50. Medium 4.3

    CVE-2026-13116 · Woocommerce PDF Invoices Packing Slips (WordPress plugin)

    PDF Invoices & Packing Slips for WooCommerce <= 5.14.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'order_id' Shortcode Attribute

    Published 11 Jul 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.