UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 7.2

    CVE-2022-2593 · Better Search Replace (WordPress plugin)

    Better Search Replace: SQL Injection

    Published 1 Aug 2022 · Fixed in 1.4.1 · WPVulnerability
  2. High 8.8

    CVE-2022-3141 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: SQL Injection

    Published 23 Jul 2022 · Fixed in 2.3.3 · WPVulnerability
  3. High 8.8

    CVE-2022-2594 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Unrestricted Upload of File with Dangerous Type

    Published 14 Jul 2022 · Fixed in 5.12.3 · NVD, WPVulnerability
  4. Medium 6.1

    CVE-2022-2090 · Woo Discount Rules (WordPress plugin)

    Discount Rules for WooCommerce: Cross-site Scripting

    Published 27 Jun 2022 · Fixed in 2.4.2 · WPVulnerability
  5. High 7.7

    CVE-2022-31090 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 20 Jun 2022 · Fixed in 2.2.3 · WPVulnerability
  6. Unrated

    WPV-c5e3a8961a8a · Flexible Shipping (WordPress plugin)

    Vulnerability in Weight Based Shipping Table Rate for WooCommerce – Flexible Shipping

    Published 14 Jun 2022 · Fixed in 4.11.9 · WPVulnerability
  7. Unrated

    WPV-a5039dad8eaf · Flexible Shipping (WordPress plugin)

    Vulnerability in Weight Based Shipping Table Rate for WooCommerce – Flexible Shipping

    Published 14 Jun 2022 · Fixed in 4.11.9 · WPVulnerability
  8. Medium 6.5

    CVE-2011-1762 · WordPress

    A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission.

    Published 18 Apr 2022 · Fixed in 3.0.6, 3.1.2 · NVD
  9. Medium 6.5

    CVE-2022-23183 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Missing Authorization

    Published 30 Mar 2022 · Fixed in 5.12.1 · NVD, WPVulnerability
  10. Medium 5.4

    CVE-2022-0765 · Loco Translate (WordPress plugin)

    Loco Translate: Cross-site Scripting

    Published 22 Mar 2022 · Fixed in 2.6.1 · WPVulnerability
  11. High 8.8

    CVE-2022-0770 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Cross-Site Request Forgery (CSRF)

    Published 7 Mar 2022 · Fixed in 2.9.9 · WPVulnerability
  12. Medium 6.3

    CVE-2022-4974 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing: Missing Authorization

    Published 4 Mar 2022 · Fixed in 1.14.3 · WPVulnerability
  13. Unrated

    WPV-346aa6f53cbb · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Vulnerability in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing

    Published 28 Feb 2022 · Fixed in 1.14.3 · WPVulnerability
  14. Unrated

    WPV-111e8cf7f970 · Woocommerce Google Adwords Conversion Tracking Tag (WordPress plugin)

    Vulnerability in Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing

    Published 28 Feb 2022 · Fixed in 1.14.3 · WPVulnerability
  15. Medium 4.7

    CVE-2021-25103 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Cross-site Scripting

    Published 10 Jan 2022 · Fixed in 2.9.7 · WPVulnerability
  16. High 7.5

    CVE-2022-21661 · WordPress

    WordPress: SQL Injection through WP_Query

    Published 6 Jan 2022 · Fixed in 5.6.7, 5.7.5, 5.8.3 · NVD, WordPress
  17. Medium 5.4

    CVE-2022-21662 · WordPress

    WordPress: Stored XSS through authenticated users

    Published 6 Jan 2022 · Fixed in 5.8.3 · NVD, WordPress
  18. High 7.2

    CVE-2022-21663 · WordPress

    WordPress: Authenticated Object Injection in Multisites

    Published 6 Jan 2022 · Fixed in 5.8.3 · NVD, WordPress
  19. High 8.8

    CVE-2022-21664 · WordPress

    WordPress: SQL injection due to improper sanitization in WP_Meta_Query

    Published 6 Jan 2022 · Fixed in 5.8.3 · NVD, WordPress
  20. Medium 6.5

    CVE-2021-20867 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Missing Authorization

    Published 2 Dec 2021 · Fixed in 5.11, 5.12.1 · NVD, WPVulnerability
  21. Critical 9.8

    CVE-2021-44223 · WordPress

    WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.

    Published 25 Nov 2021 · Fixed in 5.8 · NVD
  22. Medium 6.5

    CVE-2021-24721 · Loco Translate (WordPress plugin)

    Loco Translate: Code Injection

    Published 11 Oct 2021 · Fixed in 2.5.4 · WPVulnerability
  23. Medium 5.3

    CVE-2021-25118 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Exposure of Sensitive Information to an Unauthorized Actor

    Published 5 Oct 2021 · Fixed in 17.3 · NVD, WPVulnerability
  24. Medium 5.4

    CVE-2021-39201 · WordPress

    Authenticated cross-site scripting (XSS) in WordPress editor

    Published 9 Sept 2021 · Fixed in 5.8 · NVD, WordPress
  25. Medium 6.5

    CVE-2021-39203 · WordPress

    WordPress 5.8 beta: Private data disclosure/privilege escalation through the block editor

    Published 9 Sept 2021 · NVD, WordPress
  26. Medium 5.3

    CVE-2021-39200 · WordPress

    WordPress: Information Disclosure in wp_die() via JSONP, leading to CSRF

    Published 9 Sept 2021 · Fixed in 5.8.1 · NVD, WordPress
  27. Medium 5.4

    CVE-2021-39202 · WordPress

    WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widget editor

    Published 9 Sept 2021 · Fixed in 5.8 · NVD, WordPress
  28. Medium 4.8

    CVE-2021-24610 · Translatepress Multilingual (WordPress plugin)

    TranslatePress – Translate Multilingual sites with AI Translation: Cross-site Scripting

    Published 30 Aug 2021 · Fixed in 2.0.9 · WPVulnerability
  29. Medium 4.8

    CVE-2021-24569 · Cookie Notice (WordPress plugin)

    Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA: Cross-site Scripting

    Published 30 Aug 2021 · Fixed in 2.1.4 · WPVulnerability
  30. Medium 5.4

    CVE-2021-34641 · WP Seopress (WordPress plugin)

    SEOPress – AI SEO Plugin & On-site SEO: Cross-site Scripting

    Published 16 Aug 2021 · WPVulnerability
  31. Medium 6.1

    CVE-2021-34630 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Cross-site Scripting

    Published 23 Jul 2021 · Fixed in 2.8.65 · WPVulnerability
  32. Medium 6.1

    CVE-2021-24452 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-site Scripting

    Published 28 Jun 2021 · Fixed in 2.1.5 · WPVulnerability
  33. Medium 6.1

    CVE-2021-24436 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-site Scripting

    Published 28 Jun 2021 · Fixed in 2.1.4 · WPVulnerability
  34. Medium 5.4

    CVE-2021-24365 · Codepress Admin Columns (WordPress plugin)

    Admin Columns: Cross-site Scripting

    Published 18 Jun 2021 · Fixed in 4.3.2 · WPVulnerability
  35. Medium 5.4

    CVE-2021-24366 · Codepress Admin Columns (WordPress plugin)

    Admin Columns: Cross-site Scripting

    Published 31 May 2021 · Fixed in 4.3 · WPVulnerability
  36. High 7.2

    CVE-2021-24312 · WP Super Cache (WordPress plugin)

    WP Super Cache: OS Command Injection

    Published 14 May 2021 · Fixed in 1.7.3 · WPVulnerability
  37. Critical 9.8

    CVE-2020-36326 · PHPMailer, WordPress

    PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname. NOTE: this is similar to CVE-2018-19296, but arose because 6.1.8 fixed a functionality problem in which UNC pathnames were always considered unreadable by PHPMailer, even in safe contexts. As an unintended side effect, this fix eliminated the code that blocked addAttachment…

    Published 28 Apr 2021 · Fixed in 5.5.5, 5.6.4, 5.7.2 · NVD
  38. Medium 4.8

    CVE-2021-24427 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Cross-site Scripting

    Published 25 Apr 2021 · Fixed in 2.1.3 · WPVulnerability
  39. Medium 6.5

    CVE-2021-29447 · WordPress

    WordPress: Authenticated XXE attack when installation is running PHP 8

    Published 15 Apr 2021 · Fixed in 5.7.1 · NVD, WordPress
  40. Medium 4.3

    CVE-2021-29450 · WordPress

    WordPress: Authenticated disclosure of password-protected posts and pages

    Published 15 Apr 2021 · Fixed in 5.7.1 · NVD, WordPress
  41. Unrated

    WPV-f45c2bbf84cc · Woolentor Addons (WordPress plugin)

    Vulnerability in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin

    Published 13 Apr 2021 · Fixed in 1.8.6 · WPVulnerability
  42. Medium 5.4

    CVE-2021-24262 · Woolentor Addons (WordPress plugin)

    ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin: Cross-site Scripting

    Published 13 Apr 2021 · Fixed in 1.8.6 · WPVulnerability
  43. Medium 5.4

    CVE-2021-24329 · WP Super Cache (WordPress plugin)

    WP Super Cache: Cross-site Scripting

    Published 12 Apr 2021 · Fixed in 1.7.3 · WPVulnerability
  44. High 8.8

    CVE-2021-24159 · Contact Form 7

    Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request could be sent and the CSS settings would be successfully…

    Published 5 Apr 2021 · NVD
  45. Unrated

    WPV-f217dbc5cf8c · Official Facebook Pixel (WordPress plugin)

    Vulnerability in Meta pixel for WordPress

    Published 25 Mar 2021 · Fixed in 3.0.0 · WPVulnerability
  46. Unrated

    WPV-3643b9d5bbd1 · Official Facebook Pixel (WordPress plugin)

    Vulnerability in Meta pixel for WordPress

    Published 25 Mar 2021 · WPVulnerability
  47. High 7.1

    CVE-2026-66705 · Official Facebook Pixel (WordPress plugin)

    Meta pixel for WordPress: Cross-site Scripting

    Published 25 Mar 2021 · Fixed in 5.2.2 · WPVulnerability
  48. High 8.8

    CVE-2021-24218 · Official Facebook Pixel (WordPress plugin)

    Meta pixel for WordPress: Cross-Site Request Forgery (CSRF)

    Published 25 Mar 2021 · WPVulnerability
  49. High 8.1

    CVE-2021-24217 · Official Facebook Pixel (WordPress plugin)

    Meta pixel for WordPress: Deserialization of Untrusted Data

    Published 25 Mar 2021 · Fixed in 3.0.0 · WPVulnerability
  50. High 7.2

    CVE-2021-24209 · WP Super Cache (WordPress plugin)

    WP Super Cache: Code Injection

    Published 16 Mar 2021 · Fixed in 1.7.2 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.