UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 6.1

    CVE-2021-24241 · Advanced Custom Fields, Advanced Custom Fields Pro (WordPress plugin)

    Advanced Custom Field Pro: Cross-site Scripting

    Published 20 Jan 2021 · Fixed in 5.9.1 · NVD, WPVulnerability
  2. Medium 4.3

    CVE-2020-28040 · WordPress

    WordPress before 5.5.2 allows CSRF attacks that change a theme's background image.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  3. Critical 9.1

    CVE-2020-28039 · WordPress

    is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  4. Medium 6.1

    CVE-2020-28038 · WordPress

    WordPress before 5.5.2 allows stored XSS via post slugs.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  5. Critical 9.8

    CVE-2020-28037 · WordPress

    is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation).

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  6. Critical 9.8

    CVE-2020-28036 · WordPress

    wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  7. Critical 9.8

    CVE-2020-28035 · WordPress

    WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  8. Medium 6.1

    CVE-2020-28034 · WordPress

    WordPress before 5.5.2 allows XSS associated with global variables.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  9. High 7.5

    CVE-2020-28033 · WordPress

    WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  10. Critical 9.8

    CVE-2020-28032 · WordPress

    WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.

    Published 2 Nov 2020 · Fixed in 5.5.2 · NVD
  11. High 8.8

    CVE-2020-26596 · Elementor Pro (WordPress plugin)

    Elementor Pro: Improper Privilege Management

    Published 6 Oct 2020 · Fixed in 3.0.6 · WPVulnerability
  12. Unrated

    WPV-70df3ea01c0b · Woo Discount Rules (WordPress plugin)

    Vulnerability in Discount Rules for WooCommerce

    Published 17 Sept 2020 · Fixed in 2.2.1 · WPVulnerability
  13. Unrated

    WPV-08e53f658b62 · Woo Discount Rules (WordPress plugin)

    Vulnerability in Discount Rules for WooCommerce

    Published 17 Sept 2020 · Fixed in 2.2.1 · WPVulnerability
  14. Medium 5.3

    CVE-2020-25286 · WordPress

    In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.

    Published 13 Sept 2020 · Fixed in 5.4.2 · NVD
  15. Unrated

    WPV-7519b65d2cbf · Woo Discount Rules (WordPress plugin)

    Vulnerability in Discount Rules for WooCommerce

    Published 20 Aug 2020 · Fixed in 2.1.0 · WPVulnerability
  16. Medium 6.3

    CVE-2020-36834 · Woo Discount Rules (WordPress plugin)

    Discount Rules for WooCommerce: Missing Authorization

    Published 20 Aug 2020 · Fixed in 2.1.0 · WPVulnerability
  17. Unrated

    WPV-78cd6fde3ee0 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 1 Jul 2020 · Fixed in 1.6.0.2 · WPVulnerability
  18. Medium 5.4

    CVE-2020-4046 · WordPress

    WordPress: Authenticated XSS through embed block

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  19. Medium 6.8

    CVE-2020-4047 · WordPress

    WordPress: Authenticated XSS via media attachment page

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  20. Medium 5.7

    CVE-2020-4048 · WordPress

    WordPress: Open redirect in wp_validate_redirect()

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  21. Low 2.4

    CVE-2020-4049 · WordPress

    WordPress: Authenticated self-XSS via theme uploads

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  22. Low 3.1

    CVE-2020-4050 · WordPress

    WordPress: 'set-screen-option' filter misuse by plugins leading to privilege escalation

    Published 12 Jun 2020 · Fixed in 5.2.7, 5.3.4, 5.4.2 · NVD, WordPress
  23. Unrated

    WPV-4a82883d2f55 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 21 May 2020 · Fixed in 1.6.0.2 · WPVulnerability
  24. Medium 4.3

    CVE-2020-8934 · Google Site Kit (WordPress plugin)

    Site Kit by Google – Analytics, Search Console, AdSense, Speed: Unchecked Return Value

    Published 21 May 2020 · Fixed in 1.8.0 · WPVulnerability
  25. Medium 6.5

    CVE-2020-13125 · Elementor Pro (WordPress plugin)

    Vulnerability in Elementor Pro

    Published 17 May 2020 · Fixed in 2.9.4 · WPVulnerability
  26. Unrated

    WPV-43353581c268 · Google Site Kit (WordPress plugin)

    Vulnerability in Site Kit by Google – Analytics, Search Console, AdSense, Speed

    Published 13 May 2020 · Fixed in 1.8.0 · WPVulnerability
  27. Critical 9.9

    CVE-2020-13126 · Elementor Pro (WordPress plugin)

    Elementor Pro: Unrestricted Upload of File with Dangerous Type

    Published 6 May 2020 · Fixed in 2.9.4 · WPVulnerability
  28. Medium 5.4

    CVE-2020-11025 · WordPress

    Authenticated cross-site scripting (XSS) in WordPress Customizer

    Published 30 Apr 2020 · Fixed in 5.4.1 · NVD, WordPress
  29. Medium 5.4

    CVE-2020-11026 · WordPress

    Specially crafted filenames in WordPress leading to XSS

    Published 30 Apr 2020 · Fixed in 5.2.6, 5.3.3, 5.4.1 · NVD, WordPress
  30. High 8.1

    CVE-2020-11027 · WordPress

    Password reset links invalidation issue in WordPress

    Published 30 Apr 2020 · Fixed in 5.2.6, 5.3.3, 5.4.1 · NVD, WordPress
  31. High 7.5

    CVE-2020-11028 · WordPress

    WordPress: Unauthenticated disclosure of certain private posts

    Published 30 Apr 2020 · Fixed in 5.4.1 · NVD, WordPress
  32. Medium 6.1

    CVE-2020-11029 · WordPress

    WordPress: Cross-site scripting in stats method (object cache)

    Published 30 Apr 2020 · Fixed in 5.2.6, 5.3.3, 5.4.1 · NVD, WordPress
  33. Medium 5.4

    CVE-2020-11030 · WordPress

    Cross-site scripting (XSS) in Search block - WordPress

    Published 30 Apr 2020 · Fixed in 5.4.1 · NVD, WordPress
  34. Medium 6.1

    CVE-2020-11930 · Gtranslate (WordPress plugin)

    Translate WordPress with GTranslate: Cross-site Scripting

    Published 20 Apr 2020 · Fixed in 2.8.52 · WPVulnerability
  35. Unrated

    WPV-994e6855ed09 · SEO By Rank Math (WordPress plugin)

    Vulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

    Published 18 Apr 2020 · Fixed in 1.0.42.2 · WPVulnerability
  36. Medium 6.1

    CVE-2020-11515 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Open Redirect

    Published 25 Mar 2020 · Fixed in 1.0.0.41 · WPVulnerability
  37. Critical 9.8

    CVE-2020-11514 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 25 Mar 2020 · Fixed in 1.0.0.41 · WPVulnerability
  38. Medium 5.4

    CVE-2020-10385 · WPForms Lite

    WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Cross-site Scripting

    Published 18 Feb 2020 · Fixed in 1.5.9 · WPVulnerability
  39. Unrated

    WPV-37c0f3846c9e · Worker (WordPress plugin)

    Vulnerability in ManageWP Worker

    Published 11 Feb 2020 · Fixed in 4.9.3 · WPVulnerability
  40. Low

    CVE-2019-16788 · WordPress

    Users without "publish_posts" rights can mark sticky/unsticky a post via REST API

    Published 8 Jan 2020 · WordPress
  41. High

    CVE-2019-16773 · WordPress

    Stored cross-site scripting (XSS) through 'wp_targeted_link_rel'

    Published 8 Jan 2020 · WordPress
  42. Medium 4.3

    CVE-2019-20043 · WordPress

    In in wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php in WordPress 3.7 to 5.3.0, authenticated users who do not have the rights to publish a post are able to mark posts as sticky or unsticky via the REST API. For example, the contributor role does not have such rights, but this allowed them to bypass that. This has been patched in WordPress 5.3.1, along with all the previous…

    Published 27 Dec 2019 · Fixed in 5.3.1 · NVD
  43. Medium 6.1

    CVE-2019-20042 · WordPress

    In wp-includes/formatting.php in WordPress 3.7 to 5.3.0, the function wp_targeted_link_rel() can be used in a particular way to result in a stored cross-site scripting (XSS) vulnerability. This has been patched in WordPress 5.3.1, along with all the previous WordPress versions from 3.7 to 5.3 via a minor release.

    Published 27 Dec 2019 · Fixed in 5.3.1 · NVD
  44. Critical 9.8

    CVE-2019-20041 · WordPress

    wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing attackers to bypass input sanitization, as demonstrated by the javascript: substring.

    Published 27 Dec 2019 · Fixed in 5.3.1 · NVD
  45. Medium 5.4

    CVE-2019-16781 · WordPress

    Authenticated cross-site scripting (XSS) in WordPress block editor (within dashboard)

    Published 20 Dec 2019 · Fixed in 5.3.1 · NVD, WordPress
  46. Medium 5.4

    CVE-2019-16780 · WordPress

    Stored cross-site scripting (XSS) in WordPress block editor

    Published 20 Dec 2019 · Fixed in 5.3.1 · NVD, WordPress
  47. High 7.5

    CVE-2012-6079 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 22 Nov 2019 · Fixed in 0.9.2.5 · WPVulnerability
  48. High 7.5

    CVE-2012-6078 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 22 Nov 2019 · Fixed in 0.9.2.5 · WPVulnerability
  49. High 7.5

    CVE-2012-6077 · W3 Total Cache (WordPress plugin)

    W3 Total Cache: Exposure of Sensitive Information to an Unauthorized Actor

    Published 22 Nov 2019 · Fixed in 0.9.2.5 · WPVulnerability
  50. Medium 4.3

    CVE-2019-16251 · Yith Woocommerce Wishlist (WordPress plugin)

    Vulnerability in YITH WooCommerce Wishlist

    Published 31 Oct 2019 · Fixed in 2.2.14 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.