UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 6.5

    CVE-2026-104992 · Ameliabooking (WordPress plugin)

    Booking for Appointments and Events Calendar <= 9.9.1 - Missing Authorization to Authenticated (Custom+) Sensitive Information Disclosure via '/report/event/bookings' Endpoint

    Published 7 Nov 2026 · CVE Program
  2. High 7.5

    CVE-2026-119155 · Wpforo (WordPress plugin)

    wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter

    Published 7 Nov 2026 · CVE Program
  3. Medium 5.3

    CVE-2026-120548 · Yml For Yandex Market (WordPress plugin)

    YML for Yandex Market <= 5.10.0 - Unauthenticated Sensitive Information Exposure through Log File via 'y4ym_check_action' Parameter via admin-post.php

    Published 7 Nov 2026 · CVE Program
  4. Medium 6.5

    CVE-2026-110004 · Wpforo (WordPress plugin)

    wpForo Forum <= 3.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal via 'theme' Parameter

    Published 7 Nov 2026 · CVE Program
  5. Medium 5.4

    CVE-2026-120514 · Zephyr Project Manager (WordPress plugin)

    Zephyr Project Manager <= 3.3.209 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'zpm_profile_picture' Parameter

    Published 7 Nov 2026 · CVE Program
  6. Medium 6.5

    CVE-2026-123464 · The Events Calendar (WordPress plugin)

    WordPress The Events Calendar plugin <= 6.18.3 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  7. Medium 5.3

    CVE-2026-119502 · Ultimate Store Kit (WordPress plugin)

    WordPress Ultimate Store Kit Elementor Addons plugin <= 4.0.1 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  8. Medium 4.3

    CVE-2026-122668 · Mycred (WordPress plugin)

    WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  9. Medium 5.3

    CVE-2026-120853 · Cartflows (WordPress plugin)

    WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  10. Medium 5.3

    CVE-2026-120852 · Cartflows (WordPress plugin)

    WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability

    Published 7 Nov 2026 · CVE Program
  11. Medium 5.3

    CVE-2026-123469 · The Events Calendar (WordPress plugin)

    WordPress The Events Calendar plugin <= 6.18.3 - Content Injection vulnerability

    Published 7 Nov 2026 · CVE Program
  12. Medium 4.3

    CVE-2026-119491 · Media Library Assistant (WordPress plugin)

    WordPress Media LIbrary Assistant plugin <= 3.43 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  13. Medium 4.3

    CVE-2026-61990 · Wc Multivendor Membership (WordPress plugin)

    WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  14. Medium 6.3

    CVE-2026-119484 · Gallery By Supsystic (WordPress plugin)

    WordPress Photo Gallery by Supsystic plugin <= 1.21.6 - Cross Site Request Forgery (CSRF) vulnerability

    Published 7 Nov 2026 · CVE Program
  15. Medium 4.3

    CVE-2026-120847 · Metform (WordPress plugin)

    WordPress Metform plugin <= 4.3.3 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  16. Medium 5.3

    CVE-2026-119511 · Smart Wishlist For More Convert (WordPress plugin)

    WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  17. Medium 5.4

    CVE-2026-121766 · Powerpress (WordPress plugin)

    WordPress PowerPress Podcasting plugin <= 11.18.0 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  18. Medium 5.3

    CVE-2026-123466 · Premium Blocks For Gutenberg (WordPress plugin)

    WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  19. Medium 6.5

    CVE-2026-121768 · Cf7 Post Fields (WordPress plugin)

    WordPress Contact Form 7 &#8211; Post Fields plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  20. Medium 5.4

    CVE-2026-52713 · Learnpress (WordPress plugin)

    WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  21. Medium 5.4

    CVE-2026-119467 · Anywhere Elementor (WordPress plugin)

    WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  22. High 8.8

    CVE-2026-66669 · Superb Blocks (WordPress plugin)

    WordPress Superb Addons: Blocks, Patterns &amp; theme Designer plugin <= 4.2.4 - Cross Site Request Forgery (CSRF) vulnerability

    Published 7 Nov 2026 · CVE Program
  23. Medium 6.5

    CVE-2026-119510 · Smart Wishlist For More Convert (WordPress plugin)

    WordPress MC Woocommerce Wishlist plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  24. Medium 5.3

    CVE-2026-121781 · Fluent Booking (WordPress plugin)

    WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  25. Medium 6.5

    CVE-2026-119489 · WP Recipe Maker (WordPress plugin)

    WordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  26. Medium 4.3

    CVE-2026-120849 · Wc Multivendor Marketplace (WordPress plugin)

    WordPress WCFM Marketplace plugin <= 3.8.3 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  27. Medium 6.5

    CVE-2026-120848 · Wc Multivendor Marketplace (WordPress plugin)

    WordPress WCFM Marketplace plugin <= 3.8.3 - Cross Site Scripting (XSS) vulnerability

    Published 7 Nov 2026 · CVE Program
  28. Medium 5.3

    CVE-2026-124274 · Mycred (WordPress plugin)

    WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  29. Medium 5.4

    CVE-2026-122675 · WP Social (WordPress plugin)

    WordPress Wp Social plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability

    Published 7 Nov 2026 · CVE Program
  30. Medium 4.3

    CVE-2026-121761 · Vod Infomaniak (WordPress plugin)

    WordPress VOD Infomaniak plugin <= 1.5.15 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  31. Medium 5.3

    CVE-2026-121767 · Wedocs (WordPress plugin)

    WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  32. Medium 5.3

    CVE-2026-121778 · WP Lister For Amazon (WordPress plugin)

    WordPress WP-Lister Lite for Amazon plugin <= 2.9.2 - Broken Access Control vulnerability

    Published 7 Nov 2026 · CVE Program
  33. Medium 5.3

    CVE-2026-121779 · Yith Woocommerce Subscription (WordPress plugin)

    WordPress YITH WooCommerce Subscription plugin <= 4.22.0 - Sensitive Data Exposure vulnerability

    Published 7 Nov 2026 · CVE Program
  34. Medium 5.3

    CVE-2026-39733 · WP User Avatar (WordPress plugin)

    WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability

    Published 7 Nov 2026 · CVE Program
  35. High 8.1

    CVE-2026-104738 · Advanced Form Integration (WordPress plugin)

    Advanced Form Integration <= 2.10.2 - Unauthenticated PHP Object Injection via $_POST Parameters

    Published 7 Nov 2026 · CVE Program
  36. Medium 6.4

    CVE-2026-118800 · Ablocks (WordPress plugin)

    aBlocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute

    Published 7 Nov 2026 · CVE Program
  37. High 7.2

    CVE-2026-115811 · Strong Testimonials (WordPress plugin)

    Strong Testimonials <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via 'star_rating' Parameter

    Published 7 Nov 2026 · CVE Program
  38. Medium 4.3

    CVE-2026-118801 · Ablocks (WordPress plugin)

    aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode

    Published 7 Nov 2026 · CVE Program
  39. Medium 6.5

    CVE-2026-121792 · Gamipress (WordPress plugin)

    GamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameter

    Published 7 Nov 2026 · CVE Program
  40. Medium 5.7

    CVE-2026-120530 · WP Migration Duplicator (WordPress plugin)

    WebToffee WP Backup and Migration <= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile Biography

    Published 7 Nov 2026 · CVE Program
  41. Medium 6.4

    CVE-2026-120479 · WP Data Access (WordPress plugin)

    WP Data Access <= 5.5.90 - Authenticated (Subscriber+) Stored Cross-Site Scripting via TEXT-family Column Value in Front-end Data Project Form

    Published 7 Nov 2026 · CVE Program
  42. Medium 5.9

    CVE-2026-122265 · Vanquish Upload Files For Woocommerce (WordPress plugin)

    Vanquish Upload Files for WooCommerce <= 2.7.13 - Unauthenticated Arbitrary File Read via 'vanupfi_file_name' Parameter

    Published 7 Nov 2026 · CVE Program
  43. High 7.2

    CVE-2026-122037 · Woocommerce Jne (WordPress plugin)

    AgenWebsite Shipping <= 9.2.41 - Unauthenticated Stored Cross-Site Scripting via 'zipcode' Parameter via Setup Wizard

    Published 7 Nov 2026 · CVE Program
  44. High 8.8

    CVE-2026-87112 · Qa Heatmap Analytics (WordPress plugin)

    QA Assistants <= 5.3.0 - Unauthenticated PHP Object Injection to Remote Code Execution via 'raw_name' and 'dlevent_ver' Parameters

    Published 7 Nov 2026 · CVE Program
  45. Medium 6.4

    CVE-2026-118204 · WP Data Access (WordPress plugin)

    WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column Renderer

    Published 7 Nov 2026 · CVE Program
  46. Medium 5.3

    CVE-2026-121536 · WP Data Access (WordPress plugin)

    WP Data Access <= 5.5.90 - Authenticated (Subscriber+) SQL Injection via 'engine' Parameter

    Published 7 Nov 2026 · CVE Program
  47. Medium 5.3

    CVE-2026-93370 · Woo Paystack (WordPress plugin)

    Paystack WooCommerce Payment Gateway <= 5.8.5 - Unauthenticated Sensitive Information Exposure in 'key' Parameter on order-pay Endpoint

    Published 7 Nov 2026 · CVE Program
  48. Medium 6.4

    CVE-2026-116621 · Ultimate Member (WordPress plugin)

    Ultimate Member <= 2.14.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Custom Textarea Profile Field

    Published 7 Nov 2026 · CVE Program
  49. Medium 6.4

    CVE-2026-118048 · WP Data Access (WordPress plugin)

    WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Label

    Published 7 Nov 2026 · CVE Program
  50. Medium 6.4

    CVE-2026-120515 · WP Seopress (WordPress plugin)

    SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'seopress_google_analytics_affiliate_tracking' and 'seopress_google_analytics_download_tracking' Parameters

    Published 7 Nov 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.