Vulnerability database · updated every hour
New vulnerabilities in the software websites run.
CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.
- Tracked
- 9,657
- Published in 7 days
- 218
- Critical in 30 days
- 33
- Actively exploited
- 47
Latest vulnerabilities
9,657 vulnerabilities- High 8.5
CVE-2026-109901 · Cp Multi View Calendar (WordPress plugin)
WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability
Published 14 Oct 2026 · CVE Program - Medium 6.5
CVE-2026-101926 · Woo Poly Integration (WordPress plugin)
Hyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter
Published 14 Oct 2026 · CVE Program - Medium 6.4
CVE-2026-103369 · WP Share Buttons Analytics By Getsocial (WordPress plugin)
Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX
Published 14 Oct 2026 · CVE Program - High 7.2
CVE-2026-101924 · Newstatpress (WordPress plugin)
NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String
Published 14 Oct 2026 · CVE Program - High 7.2
CVE-2026-100153 · Newstatpress (WordPress plugin)
NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)
Published 14 Oct 2026 · CVE Program - Critical 9.8
CVE-2026-87855 · Woo Jtl Connector (WordPress plugin)
JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method
Published 14 Oct 2026 · CVE Program - High 7.2
CVE-2026-97398 · Fv Wordpress Flowplayer (WordPress plugin)
FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
Published 14 Oct 2026 · CVE Program - High 7.5
CVE-2026-95808 · Form Maker (WordPress plugin)
Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter
Published 14 Oct 2026 · CVE Program - Medium 6.4
CVE-2026-100185 · Directorist (WordPress plugin)
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field
Published 14 Oct 2026 · CVE Program - High 7.2
CVE-2026-83592 · Contact Form Db For Enfold (WordPress plugin)
Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values
Published 14 Oct 2026 · CVE Program - High 7.2
CVE-2026-95816 · Smart Forms (WordPress plugin)
Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter
Published 14 Oct 2026 · CVE Program - High 7.5
CVE-2026-78193 · Woo Jtl Connector (WordPress plugin)
JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection
Published 14 Oct 2026 · CVE Program - High 7.2
CVE-2026-94377 · Netreviews (WordPress plugin)
Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)
Published 14 Oct 2026 · CVE Program - Medium 6.4
CVE-2026-97020 · Pomo Editor (WordPress plugin)
PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter
Published 14 Oct 2026 · CVE Program - High 7.2
CVE-2026-93885 · Cryptocurrency Donation Box (WordPress plugin)
Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter
Published 14 Oct 2026 · CVE Program - High 7.2
CVE-2026-77114 · Document Gallery (WordPress plugin)
Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting
Published 14 Oct 2026 · CVE Program - Medium 6.4
CVE-2026-16495 · Widget Countdown (WordPress plugin)
Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute
Published 14 Oct 2026 · CVE Program - Medium 4.7
CVE-2026-100193 · Tutor (WordPress plugin)
Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter
Published 14 Oct 2026 · CVE Program - Medium 6.4
CVE-2026-95807 · Fv Player (WordPress plugin)
FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute
Published 14 Oct 2026 · CVE Program - Critical 9.8
CVE-2026-104800 · WP Site Age Gate (WordPress plugin)
AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php
Published 14 Oct 2026 · CVE Program - High 7.5
CVE-2026-96661 · Grand Media (WordPress plugin)
Gmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter
Published 14 Oct 2026 · CVE Program - High 7.2
CVE-2026-103422 · Anycomment (WordPress plugin)
AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
Published 14 Oct 2026 · CVE Program - Critical 9.8
CVE-2026-110002 · Snazzy Cacheable Facebook Feed (WordPress plugin)
Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter
Published 14 Oct 2026 · CVE Program - Critical 9.1
CVE-2026-92097 · Click To Chat For Whatsapp (WordPress plugin)
Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder
Published 14 Oct 2026 · CVE Program - High 8.1
CVE-2026-17092 · Directorist (WordPress plugin)
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter
Published 14 Oct 2026 · CVE Program - High 8.1
CVE-2026-104995 · Bp Profile Search (WordPress plugin)
BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value
Published 14 Oct 2026 · CVE Program - High 7.5
CVE-2026-104767 · Dfx Woo Role Changer (WordPress plugin)
Membership & User Roles for WooCommerce (Automatic Role Changer) <= 20260828 - Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache
Published 14 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-107652 · Contact Form Cfdb7 (WordPress plugin)
Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field
Published 14 Oct 2026 · CVE Program - High 7.5
CVE-2026-104749 · Bit Integrations (WordPress plugin)
Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data
Published 14 Oct 2026 · CVE Program - Medium 6.4
CVE-2026-103425 · Booking Package (WordPress plugin)
Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Published 14 Oct 2026 · CVE Program - High 7.5
CVE-2026-103423 · Booking Package (WordPress plugin)
Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'
Published 14 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-82844 · WPForms Lite
WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: Insufficient Verification of Data Authenticity
Published 14 Oct 2026 · Fixed in 2.0.2.2 · WPVulnerability - Unrated
CVE-2026-104751 · SEO By Rank Math (WordPress plugin)
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: Missing Authorization
Published 14 Oct 2026 · Fixed in 1.0.280 · WPVulnerability - Medium 5.3
CVE-2026-109898 · WP Event Solution (WordPress plugin)
WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability
Published 13 Oct 2026 · CVE Program - Medium 4.3
CVE-2026-109896 · Download Monitor Integration For Woocommerce (WordPress plugin)
WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability
Published 13 Oct 2026 · CVE Program - Medium 5.3
CVE-2026-109890 · Premium Addons For Elementor (WordPress plugin)
WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability
Published 13 Oct 2026 · CVE Program - Medium 4.3
CVE-2026-9268 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with limited permissions to modify project CI/CD deployment rollback settings without proper authorization, due to insufficient access control checks.
Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD - Critical 10.0
CVE-2026-97229 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD - High 7.3
CVE-2026-96893 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users, due to improper neutralization of special elements…
Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD - High 8.7
CVE-2026-92883 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository, due to improper sanitization of HTML attributes in syntax-highlighted…
Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD - Medium 4.2
CVE-2026-92528 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to approve a merge request despite having contributed commits to it, due to improper identity resolution.
Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD - Medium 5.3
CVE-2026-85529 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to improper authorization in the GraphQL API.
Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD - Medium 5.3
CVE-2026-84284 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, all 19.3 versions, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read work item contents from private groups and projects due to incorrect authorization checks.
Published 13 Oct 2026 · Fixed in 19.2.8, 19.4.2 · NVD - Low 3.1
CVE-2026-82632 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with a fine-grained Personal Access Token scoped only to user-boundary import permissions to import projects into group namespaces beyond the token's intended scope, due to incorrect…
Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD - High 7.7
CVE-2026-81839 · GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges due to improper cleanup of scheduled pipeline execution policy records.
Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD - Medium 5.8
CVE-2026-7767 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to an unintended server due to improper redirect validation in the Kubernetes proxy.
Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD - Medium 4.2
CVE-2026-78335 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user holding a project-scoped fine-grained Personal Access Token to modify integrations belonging to a group outside the token's scope, due to incorrect authorization checks.
Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD - Medium 4.3
CVE-2026-6567 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with reporter role to access restricted CI artifact report content they were not authorized to, due to missing authorization checks.
Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD - Medium 4.2
CVE-2026-5954 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to download package files from a public project due to improper authorization checks.
Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD - High 8.5
CVE-2026-16301 · GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization due to improper authorization checks in the downstream pipeline creation service.
Published 13 Oct 2026 · Fixed in 19.2.8, 19.3.5, 19.4.2 · NVD
Where it comes from
The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.
- NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- New records of the CVE Program, read every hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
- OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
- WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
- CISA's Known Exploited Vulnerabilities catalog.
Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.