UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 7.2

    CVE-2026-116558 · Unlimited Elements For Elementor (WordPress plugin)

    Unlimited Elements for Elementor <= 2.0.26 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Widget

    Published 7 Nov 2026 · CVE Program
  2. Medium 6.5

    CVE-2026-103917 · Quiz Master Next (WordPress plugin)

    Quiz and Survey Master (QSM) <= 11.2.7 - Unauthenticated Arbitrary Shortcode Execution via 'qsm_unique_key' Parameter

    Published 7 Nov 2026 · CVE Program
  3. Medium 6.4

    CVE-2026-110534 · Redux Framework (WordPress plugin)

    Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Name

    Published 7 Nov 2026 · CVE Program
  4. High 7.5

    CVE-2026-120043 · Slicewp (WordPress plugin)

    Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter

    Published 7 Nov 2026 · CVE Program
  5. Medium 6.5

    CVE-2026-93779 · Tutor (WordPress plugin)

    Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints

    Published 7 Nov 2026 · CVE Program
  6. Medium 5.3

    CVE-2026-110705 · Redux Framework (WordPress plugin)

    Redux Framework <= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action

    Published 7 Nov 2026 · CVE Program
  7. Medium 4.7

    CVE-2026-120477 · Stop Spammer Registrations Plugin (WordPress plugin)

    Stop Spammers Classic <= 2026.6 - Unauthenticated Stored Cross-Site Scripting via 'author' Parameter

    Published 7 Nov 2026 · CVE Program
  8. Medium 6.4

    CVE-2026-9601 · Stackable Ultimate Gutenberg Blocks (WordPress plugin)

    Stackable <= 3.19.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'save' Parameter

    Published 7 Nov 2026 · CVE Program
  9. Medium 6.1

    CVE-2026-121516 · Qode Wishlist For Woocommerce (WordPress plugin)

    QODE Wishlist for WooCommerce <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via 'table_title' Shared Wishlist Field via Guest Cookie

    Published 7 Nov 2026 · CVE Program
  10. High 7.2

    CVE-2026-120677 · Optimole WP (WordPress plugin)

    Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    Published 7 Nov 2026 · CVE Program
  11. High 7.2

    CVE-2026-119158 · Pie Register (WordPress plugin)

    Pie Register <= 3.8.4.16 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatar

    Published 7 Nov 2026 · CVE Program
  12. Medium 6.5

    CVE-2026-120560 · Profit Products Tables For Woocommerce (WordPress plugin)

    Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Unauthenticated File Deletion via 'wp_columns_actions' and 'table_id' Parameters

    Published 7 Nov 2026 · CVE Program
  13. High 7.2

    CVE-2026-120739 · Optimole WP (WordPress plugin)

    Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor

    Published 7 Nov 2026 · CVE Program
  14. Critical 9.8

    CVE-2026-19803 · Printcart Integration (WordPress plugin)

    Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter

    Published 7 Nov 2026 · CVE Program
  15. High 7.2

    CVE-2026-120540 · Iubenda Cookie Law Solution (WordPress plugin)

    iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content via IUB-COOKIE-BLOCK Marker

    Published 7 Nov 2026 · CVE Program
  16. Medium 5.4

    CVE-2026-119218 · Greenshift Animation And Page Builder Blocks (WordPress plugin)

    Greenshift <= 13.2.2 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Interaction Layer attach-attribute to Counter data-prefix

    Published 7 Nov 2026 · CVE Program
  17. Medium 5.4

    CVE-2026-120741 · Motopress Appointment Lite (WordPress plugin)

    MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint

    Published 7 Nov 2026 · CVE Program
  18. Medium 6.4

    CVE-2026-115816 · Kubio (WordPress plugin)

    Kubio AI Page Builder <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via kubio/shortcode Block via Product Review

    Published 7 Nov 2026 · CVE Program
  19. High 7.2

    CVE-2026-119175 · Nazy Load (WordPress plugin)

    Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    Published 7 Nov 2026 · CVE Program
  20. Medium 5.4

    CVE-2026-121515 · Fv Wordpress Flowplayer (WordPress plugin)

    FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    Published 7 Nov 2026 · CVE Program
  21. High 8.8

    CVE-2026-104913 · Interactive Real Estate (WordPress plugin)

    Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json

    Published 7 Nov 2026 · CVE Program
  22. Medium 5.4

    CVE-2026-118067 · Form Maker (WordPress plugin)

    Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via disabled_fields Parameter

    Published 7 Nov 2026 · CVE Program
  23. Medium 5.4

    CVE-2026-119152 · Latepoint (WordPress plugin)

    Appointment Booking Plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email Field

    Published 7 Nov 2026 · CVE Program
  24. Low 3.7

    CVE-2026-119213 · Fluent Support (WordPress plugin)

    Fluent Support <= 2.4.7 — Unauthenticated Limited Modification of Linked Customer Profile Fields via Fluent Forms Feed

    Published 7 Nov 2026 · CVE Program
  25. Medium 6.4

    CVE-2026-119098 · Lifterlms (WordPress plugin)

    LifterLMS <= 10.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Content Question Answer

    Published 7 Nov 2026 · CVE Program
  26. Medium 5.3

    CVE-2026-120555 · Jupiterx Core (WordPress plugin)

    Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter

    Published 7 Nov 2026 · CVE Program
  27. Medium 5.9

    CVE-2026-119616 · Newsletter Optin Box (WordPress plugin)

    Noptin <= 4.4.3 - Unauthenticated Local File Inclusion via 'the_template_path' Merge-Tag Attribute via Stored Subscriber first_name

    Published 7 Nov 2026 · CVE Program
  28. Medium 6.4

    CVE-2026-121519 · Instagram Slider Widget (WordPress plugin)

    Social Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' Parameter

    Published 7 Nov 2026 · CVE Program
  29. Medium 5.9

    CVE-2026-120737 · Jupiterx Core (WordPress plugin)

    Jupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameter

    Published 7 Nov 2026 · CVE Program
  30. High 7.2

    CVE-2026-120082 · Geodirectory (WordPress plugin)

    GeoDirectory <= 2.8.200 - Unauthenticated Stored Cross-Site Scripting via Nested '[gd_dynamic_content]' Shortcode in post_content

    Published 7 Nov 2026 · CVE Program
  31. Medium 5.3

    CVE-2026-120520 · Greenshift Animation And Page Builder Blocks (WordPress plugin)

    Greenshift <= 13.2.2 - Unauthenticated Sensitive Information Exposure in Nested {{COOKIE:}} Placeholder via {{GET:}} Parameter

    Published 7 Nov 2026 · CVE Program
  32. Medium 5.4

    CVE-2026-119219 · Jupiterx Core (WordPress plugin)

    Jupiter X Core <= 4.62.0 - Unauthenticated Stored Cross-Site Scripting via Raven Register Custom User Meta

    Published 7 Nov 2026 · CVE Program
  33. Medium 6.4

    CVE-2026-118046 · JS Support Ticket (WordPress plugin)

    JS Help Desk <= 5.0.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'jsticket_message' Ticket Field via VenoBox data-title

    Published 7 Nov 2026 · CVE Program
  34. High 7.2

    CVE-2026-119070 · Optimole WP (WordPress plugin)

    Optimole <= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer

    Published 7 Nov 2026 · CVE Program
  35. Medium 6.4

    CVE-2026-118054 · Learnpress Course Review (WordPress plugin)

    LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter

    Published 7 Nov 2026 · CVE Program
  36. Medium 6.4

    CVE-2026-116562 · Motors Car Dealership Classified Listings (WordPress plugin)

    Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter

    Published 7 Nov 2026 · CVE Program
  37. Critical 9.8

    CVE-2026-93754 · Payever Woocommerce Gateway (WordPress plugin)

    payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution

    Published 7 Nov 2026 · CVE Program
  38. High 7.2

    CVE-2026-120512 · Form Maker (WordPress plugin)

    Form Maker by 10Web <= 1.15.50 - Unauthenticated Stored Cross-Site Scripting via Hidden Input Field Value

    Published 7 Nov 2026 · CVE Program
  39. High 7.1

    CVE-2026-121765 · Translatepress Multilingual (WordPress plugin)

    Vulnerability in TranslatePress – Translate Multilingual sites with AI Translation

    Published 7 Nov 2026 · Fixed in 3.3.9 · CVE Program, WPVulnerability
  40. Medium 5.3

    CVE-2026-27356 · Mailchimp For WP (WordPress plugin)

    WordPress MC4WP plugin <= 4.14.1 - Broken Access Control vulnerability

    Published 6 Nov 2026 · CVE Program
  41. Medium 6.5

    CVE-2026-120845 · WP Smushit (WordPress plugin)

    WordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

    Published 6 Nov 2026 · CVE Program
  42. Medium 4.3

    CVE-2026-123471 · Mycred (WordPress plugin)

    WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability

    Published 6 Nov 2026 · CVE Program
  43. Medium 4.3

    CVE-2026-120851 · Revisionary (WordPress plugin)

    WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability

    Published 6 Nov 2026 · CVE Program
  44. Medium 4.3

    CVE-2026-119519 · Royal Elementor Addons (WordPress plugin)

    WordPress Royal Elementor Addons plugin <= 1.7.1068 - Broken Access Control vulnerability

    Published 6 Nov 2026 · CVE Program
  45. Medium 5.4

    CVE-2026-122670 · Polylang (WordPress plugin)

    WordPress Polylang plugin <= 3.9 - Broken Access Control vulnerability

    Published 6 Nov 2026 · CVE Program
  46. High 7.1

    CVE-2026-115431 · Upsell Order Bump Offer For Woocommerce (WordPress plugin)

    WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability

    Published 6 Nov 2026 · CVE Program
  47. Medium 6.5

    CVE-2026-115952 · Forminator (WordPress plugin)

    WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability

    Published 6 Nov 2026 · CVE Program
  48. Medium 5.4

    CVE-2026-103908 · Accelerated Mobile Pages (WordPress plugin)

    AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info

    Published 6 Nov 2026 · CVE Program
  49. Medium 5.4

    CVE-2026-120035 · Feedzy Rss Feeds (WordPress plugin)

    RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Title

    Published 6 Nov 2026 · CVE Program
  50. Medium 5.4

    CVE-2026-107658 · Buddyforms (WordPress plugin)

    BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion

    Published 6 Nov 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.