UpHeron

Vulnerability database · updated every hour

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
9,657
Published in 7 days
227
Critical in 30 days
33
Actively exploited
47

Latest vulnerabilities

9,657 vulnerabilities
  1. High 8.2

    CVE-2026-108480 · Skydropx (WordPress plugin)

    WordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerability

    Published 14 Oct 2026 · CVE Program
  2. High 7.1

    CVE-2026-108484 · WP Payment Form (WordPress plugin)

    WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability

    Published 14 Oct 2026 · CVE Program
  3. High 7.1

    CVE-2026-108483 · Hippoo (WordPress plugin)

    WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability

    Published 14 Oct 2026 · CVE Program
  4. High 7.1

    CVE-2026-105066 · Simply Rets (WordPress plugin)

    WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability

    Published 14 Oct 2026 · CVE Program
  5. Medium 5.3

    CVE-2026-108151 · WP Meta Data Filter And Taxonomy Filter (WordPress plugin)

    WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vulnerability

    Published 14 Oct 2026 · CVE Program
  6. High 7.5

    CVE-2026-103081 · Woo Boost Sales (WordPress plugin)

    WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability

    Published 14 Oct 2026 · CVE Program
  7. High 8.8

    CVE-2026-86461 · Fv Wordpress Flowplayer (WordPress plugin)

    FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter

    Published 14 Oct 2026 · CVE Program
  8. Medium 5.9

    CVE-2026-96596 · Erlang/OTP

    erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

    Published 14 Oct 2026 · Fixed in 29.1.2 · CVE Program
  9. Medium 6.3

    CVE-2026-105236 · Erlang/OTP

    TLS 1.2 session resumption in ssl crosses SNI virtual-host client-certificate trust boundaries

    Published 14 Oct 2026 · Fixed in 27.3.4.19, 28.5.0.8, 29.1.2 · CVE Program
  10. High 8.2

    CVE-2026-94200 · Erlang/OTP

    TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl

    Published 14 Oct 2026 · Fixed in 27.3.4.19, 28.5.0.8, 29.1.2 · CVE Program
  11. Unrated

    CVE-2026-105659 · bandit

    HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit

    Published 14 Oct 2026 · Fixed in 1.13.0 · OSV.dev and GitHub
  12. Medium 5.3

    CVE-2026-95101 · nginx

    NGINX ngx_http_v3_module vulnerability

    Published 14 Oct 2026 · Fixed in 1.30.6, 1.31.7 · CVE Program
  13. High 8.1

    CVE-2026-97205 · nginx

    NGINX ngx_http_core_module vulnerability

    Published 14 Oct 2026 · Fixed in 1.30.6, 1.31.7 · CVE Program
  14. High 8.1

    CVE-2026-93479 · nginx

    NGINX map directive and regex matching vulnerability

    Published 14 Oct 2026 · Fixed in 1.30.6, 1.31.7 · CVE Program
  15. Medium 6.5

    CVE-2026-97629 · nginx

    NGINX ngx_http_ssl_module vulnerability

    Published 14 Oct 2026 · Fixed in 1.30.6, 1.31.7 · CVE Program
  16. High 8.1

    CVE-2026-15176 · nginx

    NGINX ngx_http_core_module vulnerability

    Published 14 Oct 2026 · Fixed in 1.30.6, 1.31.7 · CVE Program
  17. Medium 6.5

    CVE-2026-107417 · Push Notification For Post And Buddypress (WordPress plugin)

    WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability

    Published 14 Oct 2026 · CVE Program
  18. High 7.3

    CVE-2026-107426 · Ppv Live Webcams (WordPress plugin)

    WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability

    Published 14 Oct 2026 · CVE Program
  19. Critical 9.8

    CVE-2026-108291 · Affiliates (WordPress plugin)

    WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability

    Published 14 Oct 2026 · CVE Program
  20. Medium 6.5

    CVE-2026-107425 · Bus Ticket Booking With Seat Reservation (WordPress plugin)

    WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability

    Published 14 Oct 2026 · CVE Program
  21. High 7.3

    CVE-2026-107421 · Videowhisper Live Streaming Integration (WordPress plugin)

    WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability

    Published 14 Oct 2026 · CVE Program
  22. Critical 9.8

    CVE-2026-107424 · Frontend Dashboard (WordPress plugin)

    WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability

    Published 14 Oct 2026 · CVE Program
  23. Medium 6.5

    CVE-2026-107422 · WP W3all Phpbb Integration (WordPress plugin)

    WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

    Published 14 Oct 2026 · CVE Program
  24. High 7.1

    CVE-2026-105874 · Surecart (WordPress plugin)

    WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability

    Published 14 Oct 2026 · CVE Program
  25. High 8.8

    CVE-2026-106599 · Surecart (WordPress plugin)

    WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability

    Published 14 Oct 2026 · CVE Program
  26. High 7.2

    CVE-2026-97278 · Polylang (WordPress plugin)

    WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

    Published 14 Oct 2026 · CVE Program
  27. Medium 6.5

    CVE-2026-107433 · Miniorange Oauth 20 Server (WordPress plugin)

    WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability

    Published 14 Oct 2026 · CVE Program
  28. High 8.5

    CVE-2026-105067 · Modern Events Calendar Lite (WordPress plugin)

    WordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability

    Published 14 Oct 2026 · Fixed in 7.37.0 · CVE Program
  29. High 7.5

    CVE-2026-103358 · Email Template Customizer For Woo (WordPress plugin)

    WordPress Email Template Customizer for WooCommerce plugin <= 1.3.4 - Content Injection vulnerability

    Published 14 Oct 2026 · CVE Program
  30. High 7.5

    CVE-2026-107431 · Jetformbuilder (WordPress plugin)

    WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability

    Published 14 Oct 2026 · CVE Program
  31. High 7.1

    CVE-2026-107428 · Ppv Live Webcams (WordPress plugin)

    WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability

    Published 14 Oct 2026 · CVE Program
  32. High 8.1

    CVE-2026-92392 · curl

    HTTP/2 upload Use-After-Free

    Published 14 Oct 2026 · CVE Program
  33. Medium 4.9

    CVE-2026-107757 · Gallery Custom Links (WordPress plugin)

    Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body

    Published 14 Oct 2026 · CVE Program
  34. High 8.1

    CVE-2026-104909 · Mangboard (WordPress plugin)

    Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter

    Published 14 Oct 2026 · CVE Program
  35. High 7.2

    CVE-2026-104764 · Post Export Import With Media (WordPress plugin)

    Post Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter

    Published 14 Oct 2026 · CVE Program
  36. Critical 9.8

    CVE-2026-104748 · Simple Form (WordPress plugin)

    SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register

    Published 14 Oct 2026 · CVE Program
  37. Medium 6.4

    CVE-2026-107650 · Geodirectory (WordPress plugin)

    GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title

    Published 14 Oct 2026 · CVE Program
  38. Medium 6.5

    CVE-2026-103907 · Jeg Elementor Kit (WordPress plugin)

    Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action

    Published 14 Oct 2026 · CVE Program
  39. High 7.2

    CVE-2026-107631 · Record Of Consent Extension For Complianz (WordPress plugin)

    Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter

    Published 14 Oct 2026 · CVE Program
  40. High 7.2

    CVE-2026-107751 · Mangboard (WordPress plugin)

    Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter

    Published 14 Oct 2026 · CVE Program
  41. Medium 6.4

    CVE-2026-107756 · Meow Lightbox (WordPress plugin)

    Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name

    Published 14 Oct 2026 · CVE Program
  42. Medium 6.4

    CVE-2026-104761 · Mangboard (WordPress plugin)

    Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter

    Published 14 Oct 2026 · CVE Program
  43. High 7.5

    CVE-2026-110284 · Lifterlms (WordPress plugin)

    LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes

    Published 14 Oct 2026 · CVE Program
  44. High 8.1

    CVE-2026-103367 · Shopmagic For Woocommerce (WordPress plugin)

    ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter

    Published 14 Oct 2026 · CVE Program
  45. Medium 6.4

    CVE-2025-9373 · Pepro Mapify (WordPress plugin)

    PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Published 14 Oct 2026 · CVE Program
  46. Medium 4.3

    CVE-2026-103380 · Latepoint (WordPress plugin)

    Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion

    Published 14 Oct 2026 · CVE Program
  47. High 7.5

    CVE-2026-103366 · Latepoint (WordPress plugin)

    Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters

    Published 14 Oct 2026 · CVE Program
  48. High 7.4

    CVE-2026-100163 · Latepoint (WordPress plugin)

    Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback

    Published 14 Oct 2026 · CVE Program
  49. Medium 6.4

    CVE-2026-107754 · Geodirectory (WordPress plugin)

    GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title

    Published 14 Oct 2026 · CVE Program
  50. Medium 5.3

    CVE-2026-110227 · Restricted Site Access (WordPress plugin)

    WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability

    Published 14 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.