UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 6.4

    CVE-2024-4617 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 15 May 2024 · Fixed in 1.0.219 · WPVulnerability
  2. Critical 9.9

    CVE-2024-34762 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Path Traversal

    Published 15 May 2024 · Fixed in 6.2.10 · WPVulnerability
  3. High 8.5

    CVE-2024-34761 · Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Code Injection

    Published 15 May 2024 · Fixed in 6.2.10 · WPVulnerability
  4. Medium 6.4

    CVE-2024-4984 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 14 May 2024 · Fixed in 22.7 · WPVulnerability
  5. Medium 4.3

    CVE-2024-34827 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Cross-Site Request Forgery (CSRF)

    Published 9 May 2024 · Fixed in 2.7.6 · WPVulnerability
  6. Medium 6.1

    CVE-2024-4041 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 6 May 2024 · Fixed in 22.6 · WPVulnerability
  7. Medium 6.1

    CVE-2024-4439 · WordPress

    WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In…

    Published 3 May 2024 · NVD
  8. Medium 5.4

    CVE-2024-4335 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 3 May 2024 · Fixed in 1.0.218 · WPVulnerability
  9. Medium 5.3

    CVE-2024-34383 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Authorization Bypass Through User-Controlled Key

    Published 3 May 2024 · Fixed in 7.7 · WPVulnerability
  10. Medium 5.3

    CVE-2023-6327 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Missing Authorization

    Published 3 May 2024 · Fixed in 2.8.8 · WPVulnerability
  11. Medium 5.4

    CVE-2024-4107 · Elementor, Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 2 May 2024 · Fixed in 3.21.1, 3.21.2 · NVD, WPVulnerability
  12. Medium 5.4

    CVE-2024-3991 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 2 May 2024 · Fixed in 2.8.8 · WPVulnerability
  13. Medium 5.3

    CVE-2024-3649 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: External Control of Assumed-Immutable Web Parameter

    Published 1 May 2024 · Fixed in 1.8.8.2 · WPVulnerability
  14. Medium 5.4

    CVE-2024-3665 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 22 Apr 2024 · Fixed in 1.0.217 · WPVulnerability
  15. Medium 4.3

    CVE-2024-32828 · Flexible Shipping (WordPress plugin)

    Weight Based Shipping Table Rate for WooCommerce – Flexible Shipping: Missing Authorization

    Published 22 Apr 2024 · Fixed in 4.24.16 · WPVulnerability
  16. Medium 5.4

    CVE-2024-1057 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 19 Apr 2024 · Fixed in 2.8.2 · WPVulnerability
  17. Medium 4.3

    CVE-2023-7067 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Missing Authorization

    Published 18 Apr 2024 · Fixed in 2.8.2 · WPVulnerability
  18. Medium 4.3

    CVE-2024-31289 · Hello Elementor (WordPress theme)

    Hello Elementor: Cross-Site Request Forgery (CSRF)

    Published 5 Apr 2024 · Fixed in 3.0.1 · WPVulnerability
  19. Medium 5.4

    CVE-2024-2946 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 4 Apr 2024 · Fixed in 2.8.5 · WPVulnerability
  20. Critical 9.8

    CVE-2024-31211 · WordPress

    Remote Code Execution in `WP_HTML_Token`

    Published 3 Apr 2024 · Fixed in 6.4.2 · NVD, WordPress
  21. High 8.8

    CVE-2024-31210 · WordPress

    PHP file upload bypass via Plugin installer

    Published 3 Apr 2024 · Fixed in 6.2.4, 6.3.3, 6.4.3 · NVD, WordPress
  22. Medium 6.4

    CVE-2024-2868 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 3 Apr 2024 · Fixed in 2.8.4 · WPVulnerability
  23. Medium 5.4

    CVE-2024-2781 · Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 26 Mar 2024 · Fixed in 3.20.2 · WPVulnerability
  24. Medium 5.4

    CVE-2024-2121 · Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 26 Mar 2024 · Fixed in 3.20.2 · WPVulnerability
  25. Medium 5.4

    CVE-2024-2120 · Elementor, Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 26 Mar 2024 · Fixed in 3.20.2 · NVD, WPVulnerability
  26. Medium 5.4

    CVE-2024-1521 · Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 26 Mar 2024 · Fixed in 3.20.2 · WPVulnerability
  27. Medium 5.4

    CVE-2024-1364 · Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 26 Mar 2024 · Fixed in 3.20.2 · WPVulnerability
  28. Medium 5.4

    CVE-2024-2165 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Improper Input Validation

    Published 22 Mar 2024 · Fixed in 7.6 · WPVulnerability
  29. Medium 5.4

    CVE-2024-2536 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Improper Input Validation

    Published 21 Mar 2024 · Fixed in 1.0.215 · WPVulnerability
  30. Medium 5.4

    CVE-2024-1960 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 14 Mar 2024 · Fixed in 2.8.2 · WPVulnerability
  31. Medium 4.3

    CVE-2024-2395 · Bulgarisation For Woocommerce (WordPress plugin)

    Bulgarisation for WooCommerce: Cross-Site Request Forgery (CSRF)

    Published 12 Mar 2024 · Fixed in 3.0.15 · WPVulnerability
  32. Medium 5.4

    CVE-2024-1894 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): Cross-site Scripting

    Published 12 Mar 2024 · Fixed in 1.5.7 · WPVulnerability
  33. High 7.5

    CVE-2024-0683 · Bulgarisation For Woocommerce (WordPress plugin)

    Bulgarisation for WooCommerce: Missing Authorization

    Published 12 Mar 2024 · Fixed in 3.0.15 · WPVulnerability
  34. Medium 6.1

    CVE-2023-6923 · Matomo

    The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a…

    Published 29 Feb 2024 · Fixed in 5.0.1 · NVD
  35. Medium 6.5

    CVE-2024-23523 · Elementor Pro (WordPress plugin)

    Elementor Pro: Exposure of Sensitive Information to an Unauthorized Actor

    Published 26 Feb 2024 · Fixed in 3.19.3 · WPVulnerability
  36. Medium 5.4

    CVE-2024-0977 · Timeline Widget Addon For Elementor (WordPress plugin)

    Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline): Cross-site Scripting

    Published 6 Feb 2024 · Fixed in 1.5.4 · WPVulnerability
  37. Critical 9.8

    CVE-2023-6933 · Better Search Replace (WordPress plugin)

    Better Search Replace: Deserialization of Untrusted Data

    Published 24 Jan 2024 · Fixed in 1.4.5 · WPVulnerability
  38. Unrated

    WPV-536b163abc4b · Advanced Custom Fields Pro (WordPress plugin)

    Vulnerability in Advanced Custom Field Pro

    Published 16 Jan 2024 · Fixed in 6.2.5 · WPVulnerability
  39. Medium 6.5

    CVE-2024-0405 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): SQL Injection

    Published 16 Jan 2024 · Fixed in 1.5.4 · WPVulnerability
  40. Medium 4.3

    CVE-2023-6630 · Contact Form 7

    The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any…

    Published 11 Jan 2024 · NVD
  41. Medium 4.8

    CVE-2023-6290 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 26 Dec 2023 · Fixed in 7.3 · WPVulnerability
  42. High 7.5

    CVE-2023-5761 · Burst Statistics (WordPress plugin)

    Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative): SQL Injection

    Published 6 Dec 2023 · Fixed in 1.5.0 · WPVulnerability
  43. Medium 5.3

    CVE-2023-41134 · Antispam Bee (WordPress plugin)

    Antispam Bee: Authentication Bypass by Spoofing

    Published 27 Nov 2023 · Fixed in 2.11.4 · WPVulnerability
  44. Medium 4.8

    CVE-2023-40680 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 24 Nov 2023 · Fixed in 21.1 · NVD, WPVulnerability
  45. Medium 5.3

    CVE-2023-5561 · WordPress

    WordPress does not properly restrict which user fields are searchable via the REST API, allowing unauthenticated attackers to discern the email addresses of users who have published public posts on an affected website via an Oracle style attack

    Published 16 Oct 2023 · Fixed in 6.1.4, 6.2.3, 6.3.2 · NVD
  46. Medium 4.3

    CVE-2023-39999 · WordPress

    Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4 through 5.4.13, from 5.3 through 5.3.15, from 5.2 through 5.2.18, from 5.1 through 5.1.16, from 5.0…

    Published 13 Oct 2023 · Fixed in 6.3.2 · NVD
  47. Medium 5.4

    CVE-2023-38000 · WordPress

    Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.

    Published 13 Oct 2023 · NVD
  48. Medium 4.8

    CVE-2023-41661 · Smarty

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions.

    Published 29 Sept 2023 · NVD
  49. Medium 4.8

    CVE-2023-4862 · Filester (WordPress plugin)

    File Manager Pro – Filester: Cross-site Scripting

    Published 19 Sept 2023 · Fixed in 1.8.1 · WPVulnerability
  50. High 7.2

    CVE-2023-4861 · Filester (WordPress plugin)

    File Manager Pro – Filester: Code Injection

    Published 19 Sept 2023 · Fixed in 1.8.1 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.