UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 7.2

    CVE-2024-9669 · Filester (WordPress plugin)

    File Manager Pro – Filester: Path Traversal

    Published 27 Nov 2024 · Fixed in 1.8.6 · WPVulnerability
  2. High 8.8

    CVE-2024-8066 · Filester (WordPress plugin)

    File Manager Pro – Filester: Unrestricted Upload of File with Dangerous Type

    Published 27 Nov 2024 · Fixed in 1.8.7 · WPVulnerability
  3. High 7.2

    CVE-2024-11620 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Code Injection

    Published 22 Nov 2024 · Fixed in 1.0.232 · WPVulnerability
  4. Critical 9.8

    CVE-2024-10961 · Oa Social Login (WordPress plugin)

    Social Login: Authentication Bypass Using an Alternate Path or Channel

    Published 22 Nov 2024 · Fixed in 5.10.0 · WPVulnerability
  5. Medium 4.3

    CVE-2024-10593 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-Site Request Forgery (CSRF)

    Published 12 Nov 2024 · Fixed in 1.9.2.1 · NVD, WPVulnerability
  6. Low 3.5

    CVE-2024-7056 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 4 Nov 2024 · Fixed in 1.9.1.6 · NVD, WPVulnerability
  7. Medium 5.4

    CVE-2026-85305 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Server-Side Request Forgery (SSRF)

    Published 24 Oct 2024 · Fixed in 10.2 · WPVulnerability
  8. Medium 5.4

    CVE-2024-50456 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Missing Authorization

    Published 24 Oct 2024 · Fixed in 8.2 · WPVulnerability
  9. Medium 4.3

    CVE-2024-50455 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Missing Authorization

    Published 24 Oct 2024 · Fixed in 8.2 · WPVulnerability
  10. Medium 5.3

    CVE-2024-50454 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Missing Authorization

    Published 24 Oct 2024 · Fixed in 8.2 · WPVulnerability
  11. Medium 5.4

    CVE-2022-4973 · WordPress

    WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into posts and pages that execute if the the_meta(); function is called on that page.

    Published 16 Oct 2024 · NVD
  12. Unrated

    WPV-b3ea7226b782 · Advanced Custom Fields Pro (WordPress plugin)

    Vulnerability in Advanced Custom Field Pro

    Published 16 Oct 2024 · Fixed in 6.3.9 · WPVulnerability
  13. Medium 6.1

    CVE-2024-8541 · Woo Discount Rules (WordPress plugin)

    Discount Rules for WooCommerce: Cross-site Scripting

    Published 15 Oct 2024 · Fixed in 2.6.6 · WPVulnerability
  14. Medium 5.3

    CVE-2024-49593 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Cross-site Scripting

    Published 15 Oct 2024 · Fixed in 6.3.9 · WPVulnerability
  15. Medium 6.5

    CVE-2024-9538 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Exposure of Sensitive Information to an Unauthorized Actor

    Published 10 Oct 2024 · Fixed in 2.9.9 · WPVulnerability
  16. Medium 6.6

    CVE-2024-9529 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Code Injection

    Published 7 Oct 2024 · Fixed in 6.3.8, 6.3.9 · NVD, WPVulnerability
  17. High 7.2

    CVE-2024-9314 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Deserialization of Untrusted Data

    Published 4 Oct 2024 · Fixed in 1.0.229 · WPVulnerability
  18. Medium 6.5

    CVE-2024-9161 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 4 Oct 2024 · Fixed in 1.0.229 · WPVulnerability
  19. Medium 6.1

    CVE-2024-9225 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 1 Oct 2024 · Fixed in 8.2 · WPVulnerability
  20. Medium 5.4

    CVE-2024-8725 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Unrestricted Upload of File with Dangerous Type

    Published 25 Sept 2024 · Fixed in 5.2.9 · WPVulnerability
  21. High 7.2

    CVE-2024-8704 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Path Traversal

    Published 25 Sept 2024 · Fixed in 5.2.9 · WPVulnerability
  22. High 8.8

    CVE-2024-8126 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Unrestricted Upload of File with Dangerous Type

    Published 25 Sept 2024 · Fixed in 5.2.9 · WPVulnerability
  23. Medium 5.4

    CVE-2024-8668 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 24 Sept 2024 · Fixed in 2.9.8 · WPVulnerability
  24. High 7.5

    CVE-2023-5359 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 23 Sept 2024 · Fixed in 2.7.6 · WPVulnerability
  25. Medium 6.1

    CVE-2024-45429 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Cross-site Scripting

    Published 4 Sept 2024 · Fixed in 6.3.6 · WPVulnerability
  26. High 7.5

    CVE-2024-7870 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Improper Authentication

    Published 3 Sept 2024 · Fixed in 9.7.2 · WPVulnerability
  27. Medium 4.4

    CVE-2022-3399 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 15 Aug 2024 · Fixed in 2.4.18 · WPVulnerability
  28. High 8.8

    CVE-2024-7031 · Filester (WordPress plugin)

    File Manager Pro – Filester: Missing Authorization

    Published 2 Aug 2024 · Fixed in 1.8.3 · WPVulnerability
  29. Low 2.7

    CVE-2024-6694 · WP Mail Smtp (WordPress plugin)

    WP Mail SMTP by WPForms – Free SMTP Plugin with Gmail, Outlook, Amazon SES, SendGrid, Mailgun, Zoho & other SMTP: Storing Passwords in a Recoverable Format

    Published 19 Jul 2024 · Fixed in 4.1.0 · WPVulnerability
  30. Unrated

    WPV-f1f8e8d7ebc0 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Vulnerability in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing

    Published 3 Jul 2024 · Fixed in 1.43.4 · WPVulnerability
  31. High 7.5

    CVE-2024-5598 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Insecure Storage of Sensitive Information

    Published 28 Jun 2024 · Fixed in 5.2.5 · WPVulnerability
  32. Medium 4.8

    CVE-2024-37447 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Cross-site Scripting

    Published 28 Jun 2024 · Fixed in 9.6.2 · WPVulnerability
  33. Medium 6.1

    CVE-2024-35656 · Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 28 Jun 2024 · Fixed in 3.21.3 · WPVulnerability
  34. Medium 4.3

    CVE-2024-37251 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Cross-Site Request Forgery (CSRF)

    Published 26 Jun 2024 · Fixed in 6.3.2 · WPVulnerability
  35. Medium 5.4

    CVE-2024-37250 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Missing Authorization

    Published 26 Jun 2024 · Fixed in 6.3.2 · WPVulnerability
  36. Medium 4.3

    CVE-2024-37249 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Missing Authorization

    Published 26 Jun 2024 · Fixed in 6.3.2 · WPVulnerability
  37. Unrated

    WPV-11f7e3fe76dc · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Vulnerability in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing

    Published 25 Jun 2024 · Fixed in 1.43.4 · WPVulnerability
  38. Medium 4.3

    CVE-2024-37236 · Loco Translate (WordPress plugin)

    Loco Translate: Cross-Site Request Forgery (CSRF)

    Published 21 Jun 2024 · Fixed in 2.6.10 · WPVulnerability
  39. Medium 5.4

    CVE-2024-1168 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 19 Jun 2024 · Fixed in 7.9.1 · WPVulnerability
  40. Critical 9.8

    CVE-2024-5488 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Deserialization of Untrusted Data

    Published 18 Jun 2024 · Fixed in 7.9 · WPVulnerability
  41. Medium 5.4

    CVE-2024-4627 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 11 Jun 2024 · Fixed in 1.0.219 · WPVulnerability
  42. Medium 5.4

    CVE-2024-5530 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 10 Jun 2024 · Fixed in 2.9.1 · WPVulnerability
  43. Medium 6.1

    CVE-2024-4900 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Open Redirect

    Published 3 Jun 2024 · Fixed in 7.8 · WPVulnerability
  44. Medium 5.0

    CVE-2024-4899 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 3 Jun 2024 · Fixed in 7.8 · WPVulnerability
  45. Medium 6.5

    CVE-2024-4565 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Improper Access Control

    Published 30 May 2024 · Fixed in 6.3, 6.3.0 · NVD, WPVulnerability
  46. Medium 5.9

    CVE-2024-34385 · Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Wishlist: Cross-site Scripting

    Published 30 May 2024 · Fixed in 3.33.0 · WPVulnerability
  47. Medium 5.4

    CVE-2024-1134 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 23 May 2024 · Fixed in 7.6 · WPVulnerability
  48. High 7.1

    CVE-2024-4566 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Missing Authorization

    Published 20 May 2024 · Fixed in 2.8.9 · WPVulnerability
  49. Medium 5.4

    CVE-2024-3345 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 20 May 2024 · Fixed in 2.8.9 · WPVulnerability
  50. Medium 5.4

    CVE-2024-34767 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 17 May 2024 · Fixed in 2.8.8 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.