Vulnerability database · updated every hour
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 9,657
- Published in 7 days
- 230
- Critical in 30 days
- 33
- Actively exploited
- 47
Latest vulnerabilities
9,657 vulnerabilities- High 7.2
CVE-2026-109207 · Feedzy Rss Feeds (WordPress plugin)
RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL
Published 16 Oct 2026 · CVE Program - Medium 5.9
CVE-2026-104769 · Debloat (WordPress plugin)
Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>
Published 16 Oct 2026 · CVE Program - High 8.1
CVE-2026-104745 · Emails Verification For Woocommerce (WordPress plugin)
Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter
Published 16 Oct 2026 · CVE Program - High 7.2
CVE-2026-109990 · Flying Scripts (WordPress plugin)
Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Published 16 Oct 2026 · CVE Program - Medium 4.9
CVE-2026-103518 · Fluent Cart (WordPress plugin)
FluentCart A New Era of eCommerce <= 1.7.0 - Authenticated (Administrator+) SQL Injection via 'products.variants' Array Keys
Published 16 Oct 2026 · CVE Program - Medium 6.4
CVE-2026-77829 · Cooked (WordPress plugin)
Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content
Published 16 Oct 2026 · CVE Program - Medium 4.8
CVE-2026-100159 · Ays Popup Box (WordPress plugin)
Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcode Execution via Client-IP / X-Forwarded-For HTTP Headers
Published 16 Oct 2026 · CVE Program - Unrated
CVE-2026-105660 · bandit
Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit
Published 15 Oct 2026 · Fixed in 1.13.0 · OSV.dev and GitHub - Medium 6.5
CVE-2026-110361 · Infinite Uploads (WordPress plugin)
WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerability
Published 15 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-110362 · Planetstudio Payment Gateway (WordPress plugin)
WordPress PlanetStudio Payment Gateway plugin <= 1.3.3 - Broken Access Control vulnerability
Published 15 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-109893 · Presto Player (WordPress plugin)
WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability
Published 15 Oct 2026 · CVE Program - Medium 4.3
CVE-2026-110374 · Login With Phone Number (WordPress plugin)
WordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vulnerability
Published 15 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-108499 · Knowledgebase (WordPress plugin)
WordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability
Published 15 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-110364 · Flexible Quantity Measurement Price Calculator For Woocommerce (WordPress plugin)
WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.23 - Broken Access Control vulnerability
Published 15 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-110375 · Download Monitor (WordPress plugin)
WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability
Published 15 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-109689 · Sunshine Photo Cart (WordPress plugin)
WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability
Published 15 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-110360 · Ajax Search Lite (WordPress plugin)
WordPress Ajax Search Lite plugin <= 4.14.5 - Broken Access Control vulnerability
Published 15 Oct 2026 · CVE Program - Medium 5.4
CVE-2026-109897 · Strong Testimonials (WordPress plugin)
WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability
Published 15 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-110378 · Ninja Signature Contract Forms Add On (WordPress plugin)
WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability
Published 15 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-96449 · WP Easy Pay (WordPress plugin)
WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability
Published 15 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-106604 · Yith Woocommerce Compare (WordPress plugin)
WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability
Published 15 Oct 2026 · CVE Program - Medium 5.4
CVE-2026-103083 · Elex Bulk Edit Products Prices Attributes For Woocommerce Basic (WordPress plugin)
WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability
Published 15 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-108175 · WP Meta Data Filter And Taxonomy Filter (WordPress plugin)
WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability
Published 15 Oct 2026 · CVE Program - Medium 6.3
CVE-2026-110381 · Simply Schedule Appointments (WordPress plugin)
WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability
Published 15 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-103350 · Booking And Rental Manager For Woocommerce (WordPress plugin)
WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerability
Published 15 Oct 2026 · CVE Program - Medium 4.3
CVE-2026-110888 · AI Engine (WordPress plugin)
WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability
Published 15 Oct 2026 · CVE Program - Medium 5.4
CVE-2026-110891 · Wordlift (WordPress plugin)
WordPress WordLift plugin <= 3.54.15 - Broken Access Control vulnerability
Published 15 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-110367 · Woosquare (WordPress plugin)
WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability
Published 15 Oct 2026 · CVE Program - Medium 4.3
CVE-2026-110371 · Strong Testimonials (WordPress plugin)
WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability
Published 15 Oct 2026 · CVE Program - Critical 9.8
CVE-2026-109686 · Link Whisper (WordPress plugin)
WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability
Published 15 Oct 2026 · CVE Program - High 7.1
CVE-2026-109685 · Link Whisper (WordPress plugin)
WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability
Published 15 Oct 2026 · CVE Program - Critical 9.8
CVE-2026-109892 · Acf Frontend Form Element (WordPress plugin)
WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability
Published 15 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-102389 · Broken Link Checker (WordPress plugin)
WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability
Published 15 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-105882 · User Registration (WordPress plugin)
WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability
Published 15 Oct 2026 · CVE Program - Critical 9.3
CVE-2026-109688 · Link Whisper (WordPress plugin)
WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability
Published 15 Oct 2026 · CVE Program - High 7.5
CVE-2026-107416 · Webba Booking Lite (WordPress plugin)
WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability
Published 15 Oct 2026 · CVE Program - High 7.1
CVE-2026-109702 · Share Button (WordPress plugin)
WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability
Published 15 Oct 2026 · CVE Program - Critical 9.3
CVE-2026-109698 · Mangboard (WordPress plugin)
WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability
Published 15 Oct 2026 · CVE Program - High 7.1
CVE-2026-109692 · User Registration (WordPress plugin)
WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability
Published 15 Oct 2026 · CVE Program - High 8.8
CVE-2026-109693 · Fluent Crm (WordPress plugin)
WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability
Published 15 Oct 2026 · CVE Program - Medium 5.4
CVE-2026-8145 · Wholesalex (WordPress plugin)
WholesaleX <= 3.0.8 - Unauthenticated Limited Privilege Escalation via 'process_registration'
Published 15 Oct 2026 · CVE Program - High 7.5
CVE-2026-109695 · Fluent Cart (WordPress plugin)
WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability
Published 15 Oct 2026 · CVE Program - Critical 9.8
CVE-2026-109694 · Fluent Crm (WordPress plugin)
WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability
Published 15 Oct 2026 · CVE Program - High 7.1
CVE-2026-108491 · Everest Forms (WordPress plugin)
WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability
Published 15 Oct 2026 · CVE Program - Critical 9.3
CVE-2026-108497 · Ameliabooking (WordPress plugin)
WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability
Published 15 Oct 2026 · CVE Program - High 7.1
CVE-2026-108498 · Bsk PDF Manager (WordPress plugin)
WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability
Published 15 Oct 2026 · CVE Program - Medium 4.3
CVE-2026-108092 · Blog2social (WordPress plugin)
Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure
Published 15 Oct 2026 · CVE Program - High 7.2
CVE-2026-18548 · Groundhogg (WordPress plugin)
Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter
Published 15 Oct 2026 · CVE Program - Critical 9.8
CVE-2026-108587 · Tenweb Speed Optimizer (WordPress plugin)
10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter
Published 15 Oct 2026 · CVE Program - Medium 6.3
CVE-2026-110762 · Bbpress (WordPress plugin)
bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream
Published 14 Oct 2026 · Fixed in 2.6.19 · CVE Program
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.