UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 7.5

    CVE-2026-9282 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Path Traversal

    Published 10 Jul 2026 · Fixed in 2.10.0 · WPVulnerability
  2. Medium 5.3

    CVE-2026-12127 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: CRLF Injection

    Published 30 Jun 2026 · Fixed in 1.10.2.1 · WPVulnerability
  3. Critical 9.0

    CVE-2026-57623 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Improper Validation of Specified Quantity in Input

    Published 29 Jun 2026 · Fixed in 2.10.0 · WPVulnerability
  4. Medium 4.3

    CVE-2026-62139 · Google Site Kit (WordPress plugin)

    Site Kit by Google – Analytics, Search Console, AdSense, Speed: Cross-Site Request Forgery (CSRF)

    Published 25 Jun 2026 · Fixed in 1.187.0 · WPVulnerability
  5. Unrated

    CVE-2026-10753 · Google Site Kit (WordPress plugin)

    Site Kit by Google – Analytics, Search Console, AdSense, Speed: Incorrect Authorization

    Published 24 Jun 2026 · Fixed in 1.176.0 · WPVulnerability
  6. High 8.1

    CVE-2026-25439 · Booknetic (WordPress plugin)

    WordPress Booknetic plugin < 5.10.3 - Broken Authentication vulnerability

    Published 17 Jun 2026 · Fixed in 5.10.3 · CVE Program
  7. Medium 5.1

    CVE-2016-20084 · Appointment Booking Calendar (WordPress plugin)

    WordPress appointment-booking-calendar 1.1.24 Privilege Escalation XSS

    Published 15 Jun 2026 · CVE Program
  8. Unrated

    CVE-2026-6382 · File Manager Advanced (WordPress plugin), Filester (WordPress plugin)

    File Manager Pro – Filester: Code Injection

    Published 15 Jun 2026 · Fixed in 2.1.1, 5.4.12 · WPVulnerability
  9. Medium 6.4

    CVE-2025-8444 · Animation Addons For Elementor (WordPress plugin)

    Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates <= 4.2.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters

    Published 10 Jun 2026 · CVE Program
  10. Critical 9.3

    CVE-2017-20251 · Insert PHP (WordPress plugin)

    WordPress Insert PHP Plugin < 3.3.1 PHP Code Injection via REST API

    Published 9 Jun 2026 · Fixed in 3.3.1 · CVE Program
  11. Unrated

    CVE-2026-4986 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Missing Authorization

    Published 9 Jun 2026 · Fixed in 1.10.0.5 · WPVulnerability
  12. Medium 5.3

    CVE-2026-7792 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Insufficient Verification of Data Authenticity

    Published 5 Jun 2026 · Fixed in 1.10.0.5 · WPVulnerability
  13. High 8.8

    CVE-2026-7654 · Codepress Admin Columns (WordPress plugin)

    Admin Columns: Deserialization of Untrusted Data

    Published 5 Jun 2026 · Fixed in 7.0.19 · WPVulnerability
  14. Medium 6.5

    CVE-2026-34892 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 3 Jun 2026 · Fixed in 1.0.271.1 · CVE Program, WPVulnerability
  15. High 7.5

    CVE-2026-48835 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Missing Authorization

    Published 28 May 2026 · Fixed in 1.10.0.5 · WPVulnerability
  16. Medium 5.3

    CVE-2025-12714 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 28 May 2026 · Fixed in 1.0.271.1 · WPVulnerability
  17. Medium 5.4

    CVE-2026-6287 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 26 May 2026 · Fixed in 3.3.9 · WPVulnerability
  18. Medium 4.3

    CVE-2025-14481 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Missing Authorization

    Published 26 May 2026 · Fixed in 26.6 · WPVulnerability
  19. Medium 4.3

    CVE-2026-97343 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Improper Authentication

    Published 13 May 2026 · Fixed in 3.7.2 · WPVulnerability
  20. Critical 9.8

    CVE-2026-8181 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Improper Authentication

    Published 13 May 2026 · Fixed in 3.4.2 · WPVulnerability
  21. High 7.2

    CVE-2026-3718 · Worker (WordPress plugin)

    ManageWP Worker: Cross-site Scripting

    Published 13 May 2026 · Fixed in 4.9.32 · WPVulnerability
  22. High 8.1

    CVE-2026-18052 · Worker (WordPress plugin)

    ManageWP Worker: Improper Authentication

    Published 13 May 2026 · Fixed in 4.9.37 · WPVulnerability
  23. Unrated

    CVE-2026-82305 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Authorization Bypass Through User-Controlled Key

    Published 7 May 2026 · Fixed in 4.18.1 · WPVulnerability
  24. Medium 5.3

    CVE-2026-27329 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Authorization Bypass Through User-Controlled Key

    Published 7 May 2026 · Fixed in 4.13.0 · WPVulnerability
  25. High 8.1

    CVE-2026-7252 · WP Optimize (WordPress plugin)

    WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance: Path Traversal

    Published 6 May 2026 · Fixed in 4.5.3 · WPVulnerability
  26. Medium 4.9

    CVE-2026-1921 · Loco Translate (WordPress plugin)

    Loco Translate: Path Traversal

    Published 4 May 2026 · Fixed in 2.8.3 · WPVulnerability
  27. Unrated

    CVE-2026-4059 · Woolentor Addons (WordPress plugin)

    Vulnerability in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

    Published 13 Apr 2026 · Fixed in 3.3.6 · WPVulnerability
  28. High 7.1

    CVE-2026-39463 · Worker (WordPress plugin)

    ManageWP Worker: Cross-site Scripting

    Published 13 Apr 2026 · Fixed in 4.9.32 · WPVulnerability
  29. Unrated

    CVE-2026-2712 · WP Optimize (WordPress plugin)

    Vulnerability in WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance

    Published 9 Apr 2026 · Fixed in 4.5.1 · WPVulnerability
  30. Unrated

    CVE-2026-5032 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 1 Apr 2026 · Fixed in 2.9.4 · WPVulnerability
  31. High 8.1

    CVE-2026-40764 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 31 Mar 2026 · Fixed in 1.10.0.3 · WPVulnerability
  32. Unrated

    CVE-2026-4146 · Loco Translate (WordPress plugin)

    Vulnerability in Loco Translate

    Published 30 Mar 2026 · Fixed in 2.8.3 · WPVulnerability
  33. Medium 6.5

    CVE-2026-25339 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Insertion of Sensitive Information Into Sent Data

    Published 23 Mar 2026 · Fixed in 1.9.9.2 · WPVulnerability
  34. Unrated

    CVE-2026-3427 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 21 Mar 2026 · Fixed in 27.2 · WPVulnerability
  35. Unrated

    CVE-2026-4432 · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Published 20 Mar 2026 · Fixed in 4.13.0 · WPVulnerability
  36. Medium 4.7

    CVE-2026-39595 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Missing Authorization

    Published 12 Mar 2026 · Fixed in 2.9.2 · WPVulnerability
  37. Medium 4.3

    CVE-2026-32446 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Missing Authorization

    Published 7 Mar 2026 · Fixed in 1.9.9.4 · WPVulnerability
  38. Critical 9.0

    CVE-2026-27384 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Improper Validation of Specified Quantity in Input

    Published 24 Feb 2026 · Fixed in 2.9.2 · WPVulnerability
  39. High 7.1

    CVE-2026-27072 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Cross-site Scripting

    Published 20 Feb 2026 · Fixed in 11.2.0.2 · WPVulnerability
  40. Unrated

    CVE-2026-1714 · Woolentor Addons (WordPress plugin)

    Vulnerability in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

    Published 17 Feb 2026 · Fixed in 3.3.3 · WPVulnerability
  41. Unrated

    CVE-2026-1841 · Pixelyoursite (WordPress plugin)

    Vulnerability in PixelYourSite – Your smart PIXEL (TAG) & API Manager

    Published 13 Feb 2026 · Fixed in 11.2.0.1 · WPVulnerability
  42. Unrated

    CVE-2026-1356 · Webp Converter For Media (WordPress plugin)

    Vulnerability in Converter for Media – Optimize images | Convert WebP & AVIF

    Published 11 Feb 2026 · Fixed in 6.5.2 · WPVulnerability
  43. Unrated

    CVE-2026-1293 · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 5 Feb 2026 · Fixed in 26.9 · WPVulnerability
  44. Medium 5.1

    CVE-2020-36919 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 13 Jan 2026 · NVD, WPVulnerability
  45. High 8.1

    CVE-2025-67934 · Wellspring (WordPress theme)

    Wellspring: PHP Remote File Inclusion

    Published 6 Jan 2026 · Fixed in 2.8 · WPVulnerability
  46. Medium 5.3

    CVE-2025-14280 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Exposure of Sensitive Information to an Unauthorized Actor

    Published 29 Dec 2025 · Fixed in 11.1.5.1 · WPVulnerability
  47. Medium 4.3

    CVE-2025-13750 · Webp Converter For Media (WordPress plugin)

    Converter for Media – Optimize images | Convert WebP & AVIF: Missing Authorization

    Published 16 Dec 2025 · Fixed in 6.4.0 · WPVulnerability
  48. Medium 6.5

    CVE-2026-94674 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Cross-site Scripting

    Published 15 Dec 2025 · Fixed in 1.69.1 · WPVulnerability
  49. Medium 5.3

    CVE-2025-67564 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Exposure of Sensitive System Information to an Unauthorized Control Sphere

    Published 9 Dec 2025 · Fixed in 1.52.0 · WPVulnerability
  50. Medium 6.4

    CVE-2025-11186 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 21 Nov 2025 · Fixed in 2.5.9 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.