UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 8.8

    CVE-2023-4827 · Filester (WordPress plugin)

    File Manager Pro – Filester: Cross-Site Request Forgery (CSRF)

    Published 11 Sept 2023 · Fixed in 1.8 · WPVulnerability
  2. Unrated

    WPV-2d2a9296eebe · Gtranslate (WordPress plugin)

    Vulnerability in Translate WordPress with GTranslate

    Published 1 Sept 2023 · Fixed in 3.0.4 · WPVulnerability
  3. Unrated

    CVE-2025-15695 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Cross-site Scripting

    Published 25 Aug 2023 · Fixed in 3.0.10 · WPVulnerability
  4. Medium 4.8

    CVE-2023-4502 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Cross-site Scripting

    Published 25 Aug 2023 · Fixed in 3.0.4 · WPVulnerability
  5. Medium 4.9

    CVE-2023-3814 · File Manager Advanced (WordPress plugin)

    Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution: Incorrect Authorization

    Published 14 Aug 2023 · Fixed in 5.1.1 · WPVulnerability
  6. Unrated

    WPV-df8b70a8ee35 · Advanced Custom Fields Pro (WordPress plugin)

    Vulnerability in Advanced Custom Field Pro

    Published 10 Aug 2023 · WPVulnerability
  7. Unrated

    WPV-d1cadcfacbd1 · Advanced Custom Fields Pro (WordPress plugin)

    Vulnerability in Advanced Custom Field Pro

    Published 10 Aug 2023 · Fixed in 6.1.8 · WPVulnerability
  8. High 7.1

    CVE-2023-33999 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Cross-site Scripting

    Published 18 Jul 2023 · Fixed in 1.32.4 · WPVulnerability
  9. Medium 6.5

    CVE-2023-32600 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Cross-site Scripting

    Published 17 Jul 2023 · Fixed in 1.0.119.1 · WPVulnerability
  10. Medium 4.3

    CVE-2022-47172 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-Site Request Forgery (CSRF)

    Published 5 Jul 2023 · Fixed in 2.6.3 · WPVulnerability
  11. Medium 6.1

    CVE-2023-1119 · WP Optimize (WordPress plugin)

    WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance: Cross-site Scripting

    Published 4 Jul 2023 · Fixed in 3.2.13 · WPVulnerability
  12. Medium 5.4

    CVE-2023-35050 · Elementor Pro (WordPress plugin)

    Elementor Pro: Missing Authorization

    Published 20 Jun 2023 · Fixed in 3.13.1 · WPVulnerability
  13. Medium 6.1

    CVE-2023-30500 · WPForms, WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 20 Jun 2023 · Fixed in 1.8.1.3 · NVD, WPVulnerability
  14. Medium 5.4

    CVE-2023-2745 · WordPress

    WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.

    Published 17 May 2023 · Fixed in 5.9.6, 6.0.4, 6.1.2 · NVD
  15. Medium 4.8

    CVE-2023-2584 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Cross-site Scripting

    Published 16 May 2023 · Fixed in 9.3.7 · WPVulnerability
  16. Medium 6.1

    CVE-2023-30777 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Cross-site Scripting

    Published 4 May 2023 · Fixed in 6.1.6 · NVD, WPVulnerability
  17. Unrated

    WPV-4e7b282ec8a2 · WP Seopress (WordPress plugin)

    Vulnerability in SEOPress – AI SEO Plugin & On-site SEO

    Published 6 Apr 2023 · Fixed in 6.5.0.3 · WPVulnerability
  18. High 7.2

    CVE-2023-1669 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Deserialization of Untrusted Data

    Published 5 Apr 2023 · Fixed in 6.5.0.3 · WPVulnerability
  19. High 8.8

    CVE-2023-1196 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Deserialization of Untrusted Data

    Published 3 Apr 2023 · Fixed in 5.12.5, 6.1.0 · NVD, WPVulnerability
  20. Unrated

    WPV-5bdf526cbb79 · Elementor Pro (WordPress plugin)

    Vulnerability in Elementor Pro

    Published 28 Mar 2023 · Fixed in 3.11.7 · WPVulnerability
  21. High 8.8

    CVE-2023-3124 · Elementor Pro (WordPress plugin)

    Elementor Pro: Missing Authorization

    Published 28 Mar 2023 · Fixed in 3.11.7 · WPVulnerability
  22. Medium 5.4

    CVE-2023-0823 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 6 Mar 2023 · Fixed in 2.4.7 · WPVulnerability
  23. Unrated

    WPV-3b3b87c1baae · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 3 Mar 2023 · Fixed in 20.2.1 · WPVulnerability
  24. Unrated

    WPV-ce051045a72f · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 2 Mar 2023 · Fixed in 20.2.1 · WPVulnerability
  25. Medium 6.5

    CVE-2023-24400 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 2 Mar 2023 · Fixed in 2.4.7 · WPVulnerability
  26. Medium 5.4

    CVE-2022-46805 · Conditional Payments For Woocommerce (WordPress plugin)

    Conditional Payments for WooCommerce: Cross-Site Request Forgery (CSRF)

    Published 14 Feb 2023 · Fixed in 2.3.2 · WPVulnerability
  27. Unrated

    WPV-062373c65986 · WP Optimize (WordPress plugin)

    Vulnerability in WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance

    Published 7 Feb 2023 · Fixed in 3.2.12 · WPVulnerability
  28. Unrated

    WPV-a7e30dbe1f41 · WP Optimize (WordPress plugin)

    Vulnerability in WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance

    Published 6 Feb 2023 · Fixed in 3.2.12 · WPVulnerability
  29. Medium 5.4

    CVE-2022-46798 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-Site Request Forgery (CSRF)

    Published 6 Feb 2023 · Fixed in 2.5.2 · WPVulnerability
  30. High 7.6

    CVE-2023-23888 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Path Traversal

    Published 30 Jan 2023 · Fixed in 1.0.119.1 · WPVulnerability
  31. Critical 9.8

    CVE-2023-0232 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Deserialization of Untrusted Data

    Published 28 Jan 2023 · Fixed in 2.5.4 · WPVulnerability
  32. Medium 5.4

    CVE-2023-0231 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 28 Jan 2023 · Fixed in 2.5.4 · WPVulnerability
  33. Unrated

    WPV-6d57087e848c · Intuitive Custom Post Order (WordPress plugin)

    Vulnerability in Intuitive Custom Post Order

    Published 25 Jan 2023 · Fixed in 3.1.4 · WPVulnerability
  34. High 7.2

    CVE-2023-1016 · Intuitive Custom Post Order (WordPress plugin)

    Intuitive Custom Post Order: SQL Injection

    Published 25 Jan 2023 · Fixed in 3.1.5 · WPVulnerability
  35. Medium 4.3

    CVE-2022-4386 · Intuitive Custom Post Order (WordPress plugin)

    Intuitive Custom Post Order: Cross-Site Request Forgery (CSRF)

    Published 24 Jan 2023 · Fixed in 3.1.4 · WPVulnerability
  36. Medium 4.3

    CVE-2022-4385 · Intuitive Custom Post Order (WordPress plugin)

    Intuitive Custom Post Order: Missing Authorization

    Published 24 Jan 2023 · Fixed in 3.1.4 · WPVulnerability
  37. Medium 4.3

    CVE-2023-22700 · Pixelyoursite (WordPress plugin)

    PixelYourSite – Your smart PIXEL (TAG) & API Manager: Cross-Site Request Forgery (CSRF)

    Published 20 Jan 2023 · Fixed in 9.3.1 · WPVulnerability
  38. Medium 5.3

    CVE-2023-22622 · WordPress

    WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the source code describes "the scenario where a site may not receive enough visits to execute scheduled tasks in a timely manner," but neither the installation guide nor the security guide mentions this default behavior, or alerts the user about security risks on…

    Published 5 Jan 2023 · NVD
  39. Medium 5.9

    CVE-2022-3590 · WordPress

    WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

    Published 14 Dec 2022 · NVD
  40. Medium 5.3

    CVE-2022-43504 · WordPress

    Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7.

    Published 5 Dec 2022 · Fixed in 5.8.6, 5.9.5, 6.0.3 · NVD
  41. Medium 6.1

    CVE-2022-43500 · WordPress

    Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.

    Published 5 Dec 2022 · Fixed in 5.8.6, 5.9.5, 6.0.3 · NVD
  42. Medium 6.1

    CVE-2022-43497 · WordPress

    Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.

    Published 5 Dec 2022 · Fixed in 5.8.6, 5.9.5, 6.0.3 · NVD
  43. Unrated

    WPV-2d3072452f6d · Yith Woocommerce Catalog Mode (WordPress plugin)

    Vulnerability in YITH WooCommerce Catalog Mode

    Published 11 Nov 2022 · Fixed in 2.16.1 · WPVulnerability
  44. Unrated

    WPV-29469e2f4254 · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Published 11 Nov 2022 · Fixed in 3.15.0 · WPVulnerability
  45. Medium 4.6

    CVE-2022-44630 · Yith Woocommerce Catalog Mode (WordPress plugin), Yith Woocommerce Wishlist (WordPress plugin)

    YITH WooCommerce Catalog Mode: Cross-Site Request Forgery (CSRF)

    Published 11 Nov 2022 · Fixed in 2.16.1, 3.15.0 · WPVulnerability
  46. Unrated

    WPV-bd4a99229dee · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 3 Oct 2022 · Fixed in 1.9 · WPVulnerability
  47. Unrated

    WPV-7527085ff0d4 · WP Super Cache (WordPress plugin)

    Vulnerability in WP Super Cache

    Published 3 Oct 2022 · Fixed in 1.9 · WPVulnerability
  48. Unrated

    WPV-89669cfe12e4 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 19 Sept 2022 · Fixed in 1.7.5.5 · WPVulnerability
  49. Unrated

    WPV-2c98b88dfcab · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 19 Sept 2022 · Fixed in 1.7.5.5 · WPVulnerability
  50. Medium 6.8

    CVE-2022-36376 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Server-Side Request Forgery (SSRF)

    Published 12 Aug 2022 · Fixed in 1.0.95.1 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.