UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 5.3

    CVE-2025-12777 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Improper Authorization

    Published 18 Nov 2025 · Fixed in 4.10.1 · WPVulnerability
  2. Medium 5.3

    CVE-2025-12545 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Exposure of Sensitive Information to an Unauthorized Actor

    Published 18 Nov 2025 · Fixed in 1.49.3 · WPVulnerability
  3. Medium 5.3

    CVE-2025-12427 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Authorization Bypass Through User-Controlled Key

    Published 18 Nov 2025 · WPVulnerability
  4. Critical 9.8

    CVE-2025-12493 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Path Traversal

    Published 3 Nov 2025 · Fixed in 3.2.6 · WPVulnerability
  5. Medium 5.3

    CVE-2025-12521 · WP Analytify Pro (WordPress plugin)

    Analytify Pro: Exposure of Sensitive Information to an Unauthorized Actor

    Published 30 Oct 2025 · Fixed in 7.0.4 · WPVulnerability
  6. Unrated

    CVE-2025-9501 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 27 Oct 2025 · Fixed in 2.8.13 · WPVulnerability
  7. Medium 6.4

    CVE-2025-11823 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

    Published 24 Oct 2025 · Fixed in 3.2.5 · WPVulnerability
  8. Low 2.7

    CVE-2025-10723 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Path Traversal

    Published 24 Oct 2025 · Fixed in 11.1.2 · WPVulnerability
  9. Medium 5.9

    CVE-2025-67554 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 21 Oct 2025 · Fixed in 2.5.9 · WPVulnerability
  10. Medium 4.3

    CVE-2025-10588 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Cross-Site Request Forgery (CSRF)

    Published 21 Oct 2025 · Fixed in 11.1.3 · WPVulnerability
  11. High 7.2

    CVE-2026-5934 · WP Rocket (WordPress plugin)

    WP Rocket: Cross-site Scripting

    Published 20 Oct 2025 · Fixed in 3.21.1 · WPVulnerability
  12. Medium 5.9

    CVE-2026-28044 · WP Rocket (WordPress plugin)

    WP Rocket: Cross-site Scripting

    Published 20 Oct 2025 · Fixed in 3.20.0.2 · WPVulnerability
  13. High 8.1

    CVE-2025-58592 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Deserialization of Untrusted Data

    Published 24 Sept 2025 · Fixed in 2.10.3 · WPVulnerability
  14. Medium 4.3

    CVE-2025-64351 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Insertion of Sensitive Information Into Sent Data

    Published 11 Sept 2025 · Fixed in 1.0.253 · WPVulnerability
  15. Low 3.8

    CVE-2025-64350 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 11 Sept 2025 · Fixed in 1.0.253 · WPVulnerability
  16. Medium 5.4

    CVE-2025-58990 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 9 Sept 2025 · Fixed in 3.2.1 · WPVulnerability
  17. Medium 6.5

    CVE-2025-0818 · File Manager Advanced (WordPress plugin), Filester (WordPress plugin)

    File Manager Pro – Filester: Path Traversal

    Published 12 Aug 2025 · Fixed in 1.9, 5.4.0 · WPVulnerability
  18. Critical 9.6

    CVE-2025-36548 · AVideo

    A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get a user to visit a webpage to trigger this vulnerability.

    Published 24 Jul 2025 · NVD
  19. Medium 4.3

    CVE-2025-53193 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Cross-Site Request Forgery (CSRF)

    Published 27 Jun 2025 · Fixed in 2.0.8 · WPVulnerability
  20. Critical 9.0

    CVE-2026-32475 · Elementor Pro (WordPress plugin)

    Elementor Pro: Unrestricted Upload of File with Dangerous Type

    Published 19 Jun 2025 · Fixed in 4.2.2 · WPVulnerability
  21. Medium 5.9

    CVE-2025-52710 · Filester (WordPress plugin)

    File Manager Pro – Filester: Cross-site Scripting

    Published 19 Jun 2025 · Fixed in 1.8.9 · WPVulnerability
  22. Medium 6.5

    CVE-2024-50555 · Elementor, Elementor Pro (WordPress plugin)

    Elementor Website Builder – more than just a page builder: Cross-site Scripting

    Published 19 Jun 2025 · Fixed in 3.29.1 · WPVulnerability
  23. Medium 6.4

    CVE-2025-6201 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Cross-site Scripting

    Published 18 Jun 2025 · Fixed in 1.49.1 · WPVulnerability
  24. Medium 6.4

    CVE-2025-5238 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Cross-site Scripting

    Published 13 Jun 2025 · Fixed in 4.6.0 · WPVulnerability
  25. High 7.2

    CVE-2025-3234 · Filester (WordPress plugin)

    File Manager Pro – Filester: Unrestricted Upload of File with Dangerous Type

    Published 13 Jun 2025 · Fixed in 1.8.9 · WPVulnerability
  26. Medium 5.4

    CVE-2025-3076 · Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 9 Jun 2025 · Fixed in 3.29.1 · WPVulnerability
  27. Medium 4.1

    CVE-2025-3951 · WP Optimize (WordPress plugin)

    WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance: SQL Injection

    Published 12 May 2025 · Fixed in 4.2.0 · WPVulnerability
  28. Medium 5.4

    CVE-2025-3794 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 9 May 2025 · Fixed in 1.9.5.1 · WPVulnerability
  29. Critical 9.8

    CVE-2025-47688 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Missing Authorization

    Published 7 May 2025 · Fixed in 5.3.2 · WPVulnerability
  30. Medium 6.5

    CVE-2025-3775 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Server-Side Request Forgery (SSRF)

    Published 24 Apr 2025 · Fixed in 3.1.3 · WPVulnerability
  31. Medium 6.5

    CVE-2025-39563 · Conditional Payments For Woocommerce (WordPress plugin)

    Conditional Payments for WooCommerce: Cross-Site Request Forgery (CSRF)

    Published 16 Apr 2025 · Fixed in 3.3.1 · WPVulnerability
  32. High 7.2

    CVE-2025-30773 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Deserialization of Untrusted Data

    Published 27 Mar 2025 · Fixed in 2.9.7 · WPVulnerability
  33. High 7.2

    CVE-2024-13889 · Wordpress Importer (WordPress plugin)

    WordPress Importer: Deserialization of Untrusted Data

    Published 25 Mar 2025 · Fixed in 0.8.4 · WPVulnerability
  34. Medium 5.4

    CVE-2025-1527 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 11 Mar 2025 · Fixed in 3.1.1 · WPVulnerability
  35. Medium 6.4

    CVE-2024-13805 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Cross-site Scripting

    Published 6 Mar 2025 · Fixed in 5.3.0 · WPVulnerability
  36. Medium 6.3

    CVE-2025-0769 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Deserialization of Untrusted Data

    Published 28 Feb 2025 · Fixed in 10.1.1.2 · WPVulnerability
  37. Medium 4.3

    CVE-2024-13229 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Improper Access Control

    Published 12 Feb 2025 · Fixed in 1.0.236 · WPVulnerability
  38. Medium 6.4

    CVE-2024-13227 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 12 Feb 2025 · Fixed in 1.0.236 · WPVulnerability
  39. Medium 5.4

    CVE-2024-13403 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 3 Feb 2025 · Fixed in 1.9.3.2 · NVD, WPVulnerability
  40. Medium 6.5

    CVE-2024-8494 · Elementor, Elementor Pro (WordPress plugin)

    Elementor Pro: Exposure of Sensitive Information to an Unauthorized Actor

    Published 29 Jan 2025 · Fixed in 3.25.11 · NVD, WPVulnerability
  41. High 7.5

    CVE-2024-13333 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Unrestricted Upload of File with Dangerous Type

    Published 16 Jan 2025 · Fixed in 5.2.14 · WPVulnerability
  42. High 8.5

    CVE-2024-12365 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Missing Authorization

    Published 13 Jan 2025 · Fixed in 2.8.2 · WPVulnerability
  43. Medium 5.3

    CVE-2024-12008 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 13 Jan 2025 · Fixed in 2.8.2 · WPVulnerability
  44. Medium 5.3

    CVE-2024-12006 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Missing Authorization

    Published 13 Jan 2025 · Fixed in 2.8.2 · WPVulnerability
  45. Medium 5.4

    CVE-2025-22300 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Cross-Site Request Forgery (CSRF)

    Published 6 Jan 2025 · Fixed in 10.0.2 · WPVulnerability
  46. High 8.8

    CVE-2024-56276 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Missing Authorization

    Published 3 Jan 2025 · Fixed in 1.9.2.3 · NVD, WPVulnerability
  47. Medium 4.3

    CVE-2024-12331 · Filester (WordPress plugin)

    File Manager Pro – Filester: Missing Authorization

    Published 18 Dec 2024 · Fixed in 1.8.7 · WPVulnerability
  48. Medium 6.5

    CVE-2024-11205 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Missing Authorization

    Published 9 Dec 2024 · Fixed in 1.9.2.2 · NVD, WPVulnerability
  49. Medium 4.7

    CVE-2024-11223 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 5 Dec 2024 · Fixed in 1.9.2.3 · NVD, WPVulnerability
  50. High 7.5

    CVE-2024-11391 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Unrestricted Upload of File with Dangerous Type

    Published 2 Dec 2024 · Fixed in 5.2.11 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.