UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 5.4

    CVE-2026-119178 · Smart Cookie Kit (WordPress plugin)

    Smart Cookie Kit <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Bundled Simple HTML DOM Noise Restoration

    Published 6 Nov 2026 · CVE Program
  2. High 8.1

    CVE-2026-92895 · Live 2d (WordPress plugin)

    Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter

    Published 6 Nov 2026 · CVE Program
  3. High 8.8

    CVE-2026-116624 · Advanced Members (WordPress plugin)

    Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form

    Published 6 Nov 2026 · CVE Program
  4. Medium 6.4

    CVE-2026-116545 · All In One Video Gallery (WordPress plugin)

    All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field

    Published 6 Nov 2026 · CVE Program
  5. Medium 4.9

    CVE-2026-119211 · Aaa Option Optimizer (WordPress plugin)

    AAA Autoload Optimizer <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' Hook

    Published 6 Nov 2026 · CVE Program
  6. Medium 6.4

    CVE-2026-116551 · Customer Area (WordPress plugin)

    WP Customer Area <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter

    Published 6 Nov 2026 · CVE Program
  7. High 7.5

    CVE-2026-104010 · Contactsheets Lite (WordPress plugin)

    WPSyncSheets For Contact Form 7 <= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission Field via maybe_unserialize()

    Published 6 Nov 2026 · CVE Program
  8. Critical 9.8

    CVE-2026-107622 · Buddyforms (WordPress plugin)

    BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter

    Published 6 Nov 2026 · CVE Program
  9. Critical 9.1

    CVE-2026-114630 · Elex Helpdesk Customer Support Ticket System (WordPress plugin)

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter

    Published 6 Nov 2026 · CVE Program
  10. Medium 6.5

    CVE-2026-89101 · Everest Forms (WordPress plugin)

    Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint

    Published 6 Nov 2026 · CVE Program
  11. High 7.6

    CVE-2026-103479 · Pubjet (WordPress plugin)

    Pubjet | پاب‌جت <= 5.4.8 - Authenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX Action

    Published 6 Nov 2026 · CVE Program
  12. Medium 4.3

    CVE-2026-115831 · Vod Infomaniak (WordPress plugin)

    VOD Infomaniak <= 1.5.15 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Video Importation via vodimportvideo AJAX Action

    Published 6 Nov 2026 · CVE Program
  13. Medium 6.4

    CVE-2026-97642 · WP Parsidate (WordPress plugin)

    Wp Parsidate <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Block Attribute

    Published 6 Nov 2026 · CVE Program
  14. Medium 5.3

    CVE-2026-120659 · Wpcf7 Redirect (WordPress plugin)

    Redirection for Contact Form 7 <= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter

    Published 6 Nov 2026 · CVE Program
  15. Medium 4.9

    CVE-2026-109977 · Yaysmtp (WordPress plugin)

    YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameter

    Published 6 Nov 2026 · CVE Program
  16. Medium 6.5

    CVE-2026-109994 · WP Event Solution (WordPress plugin)

    Eventin <= 4.1.29 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' Parameter

    Published 6 Nov 2026 · CVE Program
  17. High 7.2

    CVE-2026-110776 · WP Meta Data Filter And Taxonomy Filter (WordPress plugin)

    MDTF <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting via 'vars' Parameter

    Published 6 Nov 2026 · CVE Program
  18. High 7.2

    CVE-2026-87964 · Webappick Product Feed For Woocommerce (WordPress plugin)

    Product Feed Manager for WooCommerce <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2' Parameter

    Published 6 Nov 2026 · CVE Program
  19. Medium 6.4

    CVE-2026-120550 · WP User Manager (WordPress plugin)

    WP User Manager <= 2.10.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' User Meta

    Published 6 Nov 2026 · CVE Program
  20. Medium 6.4

    CVE-2026-122222 · Permalink Manager (WordPress plugin)

    Permalink Manager Lite <= 2.6.1 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug

    Published 6 Nov 2026 · CVE Program
  21. Medium 6.5

    CVE-2026-121794 · Tour Booking Manager (WordPress plugin)

    Travelly <= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit_form_top Handler on Tour/Hotel Edit Screen

    Published 6 Nov 2026 · CVE Program
  22. Medium 6.4

    CVE-2026-118189 · Posts Data Table (WordPress plugin)

    Posts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute

    Published 6 Nov 2026 · CVE Program
  23. High 7.2

    CVE-2026-110291 · Graphina Elementor Charts And Graphs (WordPress plugin)

    Graphina <= 3.1.13 - Unauthenticated Stored Cross-Site Scripting via Tree Chart Widget Settings

    Published 6 Nov 2026 · CVE Program
  24. Medium 6.4

    CVE-2026-120671 · Userswp (WordPress plugin)

    UsersWP <= 1.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'badge' Shortcode Attribute

    Published 6 Nov 2026 · CVE Program
  25. Critical 9.8

    CVE-2026-119516 · Radius Booking (WordPress plugin)

    WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability

    Published 6 Nov 2026 · CVE Program
  26. Medium 6.5

    CVE-2026-119472 · Redux Framework (WordPress plugin)

    WordPress Redux Framework plugin <= 4.5.16 - Cross Site Scripting (XSS) vulnerability

    Published 6 Nov 2026 · CVE Program
  27. Critical 9.8

    CVE-2026-120844 · Miniorange Login With Eve Online Google Facebook (WordPress plugin)

    WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability

    Published 6 Nov 2026 · CVE Program
  28. High 7.1

    CVE-2026-39744 · Wc Multivendor Membership (WordPress plugin)

    WordPress WCFM Membership plugin <= 2.12.0 - Cross Site Scripting (XSS) vulnerability

    Published 6 Nov 2026 · CVE Program
  29. High 7.1

    CVE-2026-119488 · Pie Register (WordPress plugin)

    WordPress Pie Register plugin <= 3.8.4.15 - Cross Site Scripting (XSS) vulnerability

    Published 6 Nov 2026 · CVE Program
  30. High 7.5

    CVE-2026-119499 · Bakkbone Florist Companion (WordPress plugin)

    WordPress FloristPress plugin <= 7.8.4 - Sensitive Data Exposure vulnerability

    Published 6 Nov 2026 · CVE Program
  31. High 7.2

    CVE-2026-120537 · Translatepress Multilingual (WordPress plugin)

    Vulnerability in TranslatePress – Translate Multilingual sites with AI Translation

    Published 6 Nov 2026 · Fixed in 3.3.9 · CVE Program, WPVulnerability
  32. Medium 6.9

    CVE-2026-119751 · Content Egg (WordPress plugin)

    Content Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocks

    Published 5 Nov 2026 · CVE Program
  33. High 8.8

    CVE-2026-118193 · Give (WordPress plugin)

    GiveWP <= 4.19.1 - Authenticated (Custom+) Privilege Escalation to 'donor_default_user_role' Parameter

    Published 5 Nov 2026 · CVE Program
  34. Medium 6.4

    CVE-2026-120533 · Redux Framework (WordPress plugin)

    Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile

    Published 5 Nov 2026 · CVE Program
  35. Medium 6.4

    CVE-2026-104812 · Redux Framework (WordPress plugin)

    Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key

    Published 5 Nov 2026 · CVE Program
  36. High 8.1

    CVE-2026-116617 · Motors Car Dealership Classified Listings (WordPress plugin)

    Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter

    Published 5 Nov 2026 · CVE Program
  37. Medium 6.4

    CVE-2026-120553 · Customer Reviews Woocommerce (WordPress plugin)

    Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute

    Published 5 Nov 2026 · CVE Program
  38. Critical 9.1

    CVE-2026-122220 · Wpo365 Login (WordPress plugin)

    WPO365 LOGIN before 45.2 SAML Replay Protection Bypass

    Published 4 Nov 2026 · Fixed in 45.2 · CVE Program
  39. High 8.7

    CVE-2026-119749 · Invoicing (WordPress plugin)

    GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass

    Published 4 Nov 2026 · Fixed in 2.8.63 · CVE Program
  40. Medium 6.9

    CVE-2026-119748 · Invoicing (WordPress plugin)

    GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice

    Published 4 Nov 2026 · Fixed in 2.8.63 · CVE Program
  41. High 7.1

    CVE-2026-119747 · Invoicing (WordPress plugin)

    GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API

    Published 4 Nov 2026 · Fixed in 2.8.63 · CVE Program
  42. Medium 5.3

    CVE-2026-119745 · Sender Net Automated Emails (WordPress plugin)

    Sender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download

    Published 4 Nov 2026 · Fixed in 2.11.3 · CVE Program
  43. Medium 5.3

    CVE-2026-121993 · Wepos (WordPress plugin)

    wePOS before 2.0.3 Missing Authorization via payment/process Endpoint

    Published 4 Nov 2026 · Fixed in 2.0.3 · CVE Program
  44. Medium 6.3

    CVE-2026-121970 · Woo Vipps (WordPress plugin)

    Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery

    Published 4 Nov 2026 · Fixed in 6.4.1 · CVE Program
  45. High 7.1

    CVE-2026-119468 · Newsletter Optin Box (WordPress plugin)

    WordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability

    Published 4 Nov 2026 · CVE Program
  46. Critical 9.8

    CVE-2026-119481 · Jetformbuilder (WordPress plugin)

    WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability

    Published 4 Nov 2026 · CVE Program
  47. Critical 9.8

    CVE-2026-65555 · Uncanny Learndash Toolkit (WordPress plugin)

    WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability

    Published 4 Nov 2026 · CVE Program
  48. High 8.8

    CVE-2026-104799 · Mobile Builder (WordPress plugin)

    Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters

    Published 4 Nov 2026 · CVE Program
  49. High 7.2

    CVE-2026-97397 · Use Bunnyfont Host Google Fonts (WordPress plugin)

    Remove Google Fonts <= 1.7 - Unauthenticated Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer

    Published 4 Nov 2026 · CVE Program
  50. High 7.2

    CVE-2026-115498 · Slimjetpack (WordPress plugin)

    Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field

    Published 4 Nov 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.