UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
810
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 8.8

    CVE-2019-17661 · Codepress Admin Columns (WordPress plugin)

    Admin Columns: Injection

    Published 29 Oct 2019 · WPVulnerability
  2. High 8.8

    CVE-2019-17675 · WordPress

    WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  3. Medium 5.4

    CVE-2019-17674 · WordPress

    WordPress before 5.2.4 is vulnerable to stored XSS (cross-site scripting) via the Customizer.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  4. High 7.5

    CVE-2019-17673 · WordPress

    WordPress before 5.2.4 is vulnerable to poisoning of the cache of JSON GET requests because certain requests lack a Vary: Origin header.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  5. Medium 6.1

    CVE-2019-17672 · WordPress

    WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  6. Medium 5.3

    CVE-2019-17671 · WordPress

    In WordPress before 5.2.4, unauthenticated viewing of certain content is possible because the static query property is mishandled.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  7. Critical 9.8

    CVE-2019-17670 · WordPress

    WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because Windows paths are mishandled during certain validation of relative URLs.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  8. Critical 9.8

    CVE-2019-17669 · WordPress

    WordPress before 5.2.4 has a Server Side Request Forgery (SSRF) vulnerability because URL validation does not consider the interpretation of a name as a series of hex characters.

    Published 17 Oct 2019 · Fixed in 5.2.4 · NVD
  9. Medium 6.5

    CVE-2016-10983 · Ghost

    The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data.

    Published 17 Sept 2019 · Fixed in 0.5.6 · NVD
  10. Medium 5.4

    CVE-2019-16223 · WordPress

    WordPress before 5.2.3 allows XSS in post previews by authenticated users.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  11. Medium 6.1

    CVE-2019-16222 · WordPress

    WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  12. Medium 6.1

    CVE-2019-16221 · WordPress

    WordPress before 5.2.3 allows reflected XSS in the dashboard.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  13. Medium 6.1

    CVE-2019-16220 · WordPress

    In WordPress before 5.2.3, validation and sanitization of a URL in wp_validate_redirect in wp-includes/pluggable.php could lead to an open redirect if a provided URL path does not start with a forward slash.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  14. Medium 6.1

    CVE-2019-16219 · WordPress

    WordPress before 5.2.3 allows XSS in shortcode previews.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  15. Medium 6.1

    CVE-2019-16218 · WordPress

    WordPress before 5.2.3 allows XSS in stored comments.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  16. Medium 6.1

    CVE-2019-16217 · WordPress

    WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.

    Published 11 Sept 2019 · Fixed in 5.2.3 · NVD
  17. Medium 6.1

    CVE-2019-14774 · Woo Variation Swatches (WordPress plugin)

    Variation Swatches for WooCommerce: Cross-site Scripting

    Published 8 Aug 2019 · Fixed in 1.0.62 · WPVulnerability
  18. Critical 9.8

    CVE-2019-13478 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Cross-site Scripting

    Published 9 Jul 2019 · Fixed in 11.6 · NVD, WPVulnerability
  19. Unrated

    WPV-6e89637e6d14 · Webp Converter For Media (WordPress plugin)

    Vulnerability in Converter for Media – Optimize images | Convert WebP & AVIF

    Published 27 Jun 2019 · Fixed in 1.0.3 · WPVulnerability
  20. High 8.8

    CVE-2019-15834 · Webp Converter For Media (WordPress plugin)

    Converter for Media – Optimize images | Convert WebP & AVIF: Cross-Site Request Forgery (CSRF)

    Published 27 Jun 2019 · Fixed in 1.0.3 · WPVulnerability
  21. Unrated

    WPV-d171dacac5c5 · SEO By Rank Math (WordPress plugin)

    Vulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

    Published 25 Jun 2019 · Fixed in 1.0.27.1 · WPVulnerability
  22. Medium 6.5

    CVE-2019-14786 · SEO By Rank Math (WordPress plugin)

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization

    Published 21 Jun 2019 · Fixed in 1.0.27.1 · WPVulnerability
  23. Unrated

    WPV-d318cf3b79ed · SEO By Rank Math (WordPress plugin)

    Vulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

    Published 18 Jun 2019 · Fixed in 1.0.27 · WPVulnerability
  24. Unrated

    WPV-49859c410c18 · SEO By Rank Math (WordPress plugin)

    Vulnerability in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings

    Published 18 Jun 2019 · Fixed in 1.0.27 · WPVulnerability
  25. Medium 5.3

    CVE-2017-6514 · WordPress

    WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring.

    Published 22 May 2019 · NVD
  26. Unrated

    WPV-2cc0f858820e · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 22 May 2019 · Fixed in 0.9.7.4 · WPVulnerability
  27. Unrated

    WPV-dfb1909e42f7 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 7 May 2019 · Fixed in 0.9.7.4 · WPVulnerability
  28. Unrated

    WPV-6e0c6fcf8e01 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 7 May 2019 · Fixed in 0.9.7.4 · WPVulnerability
  29. Unrated

    WPV-3babf47eb536 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 7 May 2019 · Fixed in 0.9.7.4 · WPVulnerability
  30. High 7.5

    CVE-2019-6715 · W3 Total Cache (WordPress plugin)

    Vulnerability in W3 Total Cache

    Published 1 Apr 2019 · Fixed in 0.9.4 · WPVulnerability
  31. High 8.8

    CVE-2019-9787 · WordPress

    WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is…

    Published 14 Mar 2019 · Fixed in 5.1.1 · NVD
  32. Medium 6.5

    CVE-2019-8943 · WordPress

    WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.

    Published 20 Feb 2019 · NVD
  33. High 8.8

    CVE-2019-8942 · WordPress

    WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image containing PHP code in the Exif metadata. Exploitation can leverage CVE-2019-8943.

    Published 20 Feb 2019 · Fixed in 4.9.9 · NVD
  34. Medium 5.4

    CVE-2018-20153 · WordPress

    In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could modify new comments made by users with greater privileges, possibly causing XSS.

    Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD
  35. Medium 6.5

    CVE-2018-20152 · WordPress

    In WordPress before 4.9.9 and 5.x before 5.0.1, authors could bypass intended restrictions on post types via crafted input.

    Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD
  36. High 7.5

    CVE-2018-20151 · WordPress

    In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and (rarely) the password that was generated by default.

    Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD
  37. Medium 6.1

    CVE-2018-20150 · WordPress

    In WordPress before 4.9.9 and 5.x before 5.0.1, crafted URLs could trigger XSS for certain use cases involving plugins.

    Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD
  38. Medium 5.4

    CVE-2018-20149 · WordPress

    In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.

    Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD
  39. Critical 9.8

    CVE-2018-20148 · WordPress

    In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wp_get_attachment_thumb_file function in wp-includes/post.php.

    Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD
  40. Medium 6.5

    CVE-2018-20147 · WordPress

    In WordPress before 4.9.9 and 5.x before 5.0.1, authors could modify metadata to bypass intended restrictions on deleting files.

    Published 14 Dec 2018 · Fixed in 4.9.9, 5.0.1 · NVD
  41. Unrated

    WPV-9841f281bc2b · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 10 Dec 2018 · Fixed in 1.4.8.1 · WPVulnerability
  42. Unrated

    WPV-5915ef436117 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 10 Dec 2018 · Fixed in 1.4.8.1 · WPVulnerability
  43. Unrated

    WPV-e93844f8f8ff · WP Mail Smtp (WordPress plugin)

    Vulnerability in WP Mail SMTP by WPForms – Free SMTP Plugin with Gmail, Outlook, Amazon SES, SendGrid, Mailgun, Zoho & other SMTP

    Published 7 Dec 2018 · Fixed in 1.4.0 · WPVulnerability
  44. Unrated

    WPV-d363ba651db3 · WPForms Lite

    Vulnerability in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

    Published 7 Dec 2018 · Fixed in 1.4.8 · WPVulnerability
  45. Unrated

    WPV-c76079ebced5 · Redirection (WordPress plugin)

    Vulnerability in Redirection

    Published 6 Dec 2018 · Fixed in 3.6.4 · WPVulnerability
  46. Unrated

    WPV-deceef5f25eb · Yoast SEO

    Vulnerability in Yoast SEO – Advanced SEO with real-time guidance and built-in AI

    Published 20 Nov 2018 · Fixed in 9.2.0 · WPVulnerability
  47. High 8.8

    CVE-2018-19296 · PHPMailer, WordPress

    PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.

    Published 16 Nov 2018 · Fixed in 5.2.27, 6.0.6 · NVD
  48. Unrated

    WPV-5af05bf9a2a3 · Redirection (WordPress plugin)

    Vulnerability in Redirection

    Published 14 Nov 2018 · Fixed in 3.6.4 · WPVulnerability
  49. Medium 6.6

    CVE-2018-19370 · Yoast SEO

    Yoast SEO – Advanced SEO with real-time guidance and built-in AI: Race Condition

    Published 6 Nov 2018 · Fixed in 9.2.0 · NVD, WPVulnerability
  50. Medium 6.1

    CVE-2018-18379 · Elementor Pro (WordPress plugin)

    Elementor Pro: Cross-site Scripting

    Published 26 Oct 2018 · Fixed in 2.0.10 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.