UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 8.8

    CVE-2026-120554 · Import Users From Csv With Meta (WordPress plugin)

    Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save

    Published 4 Nov 2026 · CVE Program
  2. Medium 6.4

    CVE-2026-93900 · Simple Cloudflare Turnstile (WordPress plugin)

    Simple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

    Published 4 Nov 2026 · CVE Program
  3. High 7.1

    CVE-2026-57666 · Customer Area (WordPress plugin)

    WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability

    Published 4 Nov 2026 · CVE Program
  4. High 7.1

    CVE-2026-119366 · Wpdiscuz (WordPress plugin)

    WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability

    Published 4 Nov 2026 · CVE Program
  5. High 7.1

    CVE-2026-62007 · Unlimited Elements For Elementor (WordPress plugin)

    WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability

    Published 4 Nov 2026 · CVE Program
  6. High 7.1

    CVE-2026-54861 · Customer Area (WordPress plugin)

    WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability

    Published 4 Nov 2026 · CVE Program
  7. High 7.5

    CVE-2026-62126 · Miniorange Saml 20 Single Sign On (WordPress plugin)

    WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability

    Published 4 Nov 2026 · CVE Program
  8. Medium 5.3

    CVE-2026-57775 · Simple Cloudflare Turnstile (WordPress plugin)

    WordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Broken Authentication vulnerability

    Published 4 Nov 2026 · CVE Program
  9. High 7.1

    CVE-2026-57639 · WP Booking System (WordPress plugin)

    WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability

    Published 4 Nov 2026 · CVE Program
  10. High 7.1

    CVE-2026-119477 · WP Photo Album Plus (WordPress plugin)

    WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability

    Published 4 Nov 2026 · CVE Program
  11. High 7.5

    CVE-2026-56065 · Doofinder For Woocommerce (WordPress plugin)

    WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability

    Published 4 Nov 2026 · CVE Program
  12. High 7.5

    CVE-2026-62000 · Wc Multivendor Marketplace (WordPress plugin)

    WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability

    Published 4 Nov 2026 · CVE Program
  13. Medium 5.3

    CVE-2026-119509 · Clickcease Click Fraud Protection (WordPress plugin)

    WordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerability

    Published 3 Nov 2026 · CVE Program
  14. Medium 4.3

    CVE-2026-97072 · Mycred (WordPress plugin)

    WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

    Published 3 Nov 2026 · CVE Program
  15. Medium 5.3

    CVE-2026-114187 · Anywhere Elementor (WordPress plugin)

    WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability

    Published 3 Nov 2026 · CVE Program
  16. Medium 4.3

    CVE-2026-103077 · Mycred (WordPress plugin)

    WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

    Published 3 Nov 2026 · CVE Program
  17. Medium 6.5

    CVE-2026-114185 · Anywhere Elementor (WordPress plugin)

    WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    Published 3 Nov 2026 · CVE Program
  18. Medium 5.3

    CVE-2026-119485 · Dokan Lite (WordPress plugin)

    WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

    Published 3 Nov 2026 · CVE Program
  19. Medium 4.3

    CVE-2026-39777 · Wc Multivendor Membership (WordPress plugin)

    WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability

    Published 3 Nov 2026 · CVE Program
  20. Medium 5.3

    CVE-2026-119487 · Dokan Lite (WordPress plugin)

    WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

    Published 3 Nov 2026 · CVE Program
  21. Medium 6.5

    CVE-2026-120843 · Posts Data Table (WordPress plugin)

    WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability

    Published 3 Nov 2026 · CVE Program
  22. Medium 6.5

    CVE-2026-114183 · Anywhere Elementor (WordPress plugin)

    WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

    Published 3 Nov 2026 · CVE Program
  23. Medium 5.3

    CVE-2026-116859 · Forminator (WordPress plugin)

    WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability

    Published 3 Nov 2026 · CVE Program
  24. Medium 4.3

    CVE-2026-116858 · Forminator (WordPress plugin)

    WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability

    Published 3 Nov 2026 · CVE Program
  25. Medium 5.3

    CVE-2026-39743 · Wc Multivendor Membership (WordPress plugin)

    WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability

    Published 3 Nov 2026 · CVE Program
  26. Medium 5.3

    CVE-2026-120846 · Uncanny Automator (WordPress plugin)

    WordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerability

    Published 3 Nov 2026 · CVE Program
  27. Medium 6.5

    CVE-2026-119521 · Paid Member Subscriptions (WordPress plugin)

    WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

    Published 3 Nov 2026 · CVE Program
  28. Medium 5.3

    CVE-2026-119495 · Better Search (WordPress plugin)

    WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerability

    Published 3 Nov 2026 · CVE Program
  29. Medium 5.3

    CVE-2026-120578 · AI Alt Text Generator (WordPress plugin)

    AI Alt Text Generator <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter

    Published 3 Nov 2026 · CVE Program
  30. High 8.1

    CVE-2026-120538 · Easy Digital Downloads (WordPress plugin)

    Easy Digital Downloads <= 3.7.2 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Guest Checkout Email Binding at PayPal Capture

    Published 3 Nov 2026 · CVE Program
  31. High 8.1

    CVE-2026-120577 · Fluent Cart (WordPress plugin)

    FluentCart A New Era of eCommerce <= 1.6.2 - Authenticated (Custom+) Arbitrary File Deletion via 'file_path' Parameter

    Published 3 Nov 2026 · CVE Program
  32. Medium 6.4

    CVE-2026-120575 · Wplr Sync (WordPress plugin)

    Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name

    Published 3 Nov 2026 · CVE Program
  33. High 8.1

    CVE-2026-120574 · Surecart (WordPress plugin)

    SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover

    Published 3 Nov 2026 · CVE Program
  34. Medium 4.9

    CVE-2026-120563 · Woocommerce Multilingual (WordPress plugin)

    WPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field

    Published 3 Nov 2026 · CVE Program
  35. Medium 5.3

    CVE-2026-120561 · Jetformbuilder (WordPress plugin)

    JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification

    Published 3 Nov 2026 · CVE Program
  36. High 7.5

    CVE-2026-120559 · Contact Form Extender For Divi Builder (WordPress plugin)

    Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal

    Published 3 Nov 2026 · CVE Program
  37. Medium 6.4

    CVE-2026-120524 · News Kit Elementor Addons (WordPress plugin)

    News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action

    Published 3 Nov 2026 · CVE Program
  38. High 7.2

    CVE-2026-120558 · Woo Advanced Shipment Tracking (WordPress plugin)

    Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter

    Published 3 Nov 2026 · CVE Program
  39. Medium 6.4

    CVE-2026-120552 · SEO Engine (WordPress plugin)

    SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()

    Published 3 Nov 2026 · CVE Program
  40. Medium 5.3

    CVE-2026-120551 · WP Compress Image Optimizer (WordPress plugin)

    WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters

    Published 3 Nov 2026 · CVE Program
  41. Medium 4.3

    CVE-2026-120544 · Academy (WordPress plugin)

    Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route

    Published 3 Nov 2026 · CVE Program
  42. Critical 9.1

    CVE-2026-120518 · Buddypress Xprofile Image Field (WordPress plugin)

    BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler

    Published 3 Nov 2026 · CVE Program
  43. Medium 5.9

    CVE-2026-111464 · WP Fastest Cache (WordPress plugin)

    WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response

    Published 3 Nov 2026 · CVE Program
  44. Medium 5.3

    CVE-2026-120597 · Usc E Shop (WordPress plugin)

    Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting

    Published 2 Nov 2026 · CVE Program
  45. Critical 9.8

    CVE-2026-86596 · S2member (WordPress plugin)

    s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter

    Published 2 Nov 2026 · CVE Program
  46. Critical 9.8

    CVE-2026-102435 · Ultimate Addons For Contact Form 7 (WordPress plugin)

    Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field

    Published 2 Nov 2026 · CVE Program
  47. High 8.6

    CVE-2026-120318 · Woo Product Gallery Slider (WordPress plugin)

    Product Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX

    Published 2 Nov 2026 · Fixed in 2.3.26 · CVE Program
  48. High 7.1

    CVE-2026-66570 · WP File Upload (WordPress plugin)

    WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability

    Published 1 Nov 2026 · CVE Program
  49. Medium 6.5

    CVE-2026-119480 · Jetformbuilder (WordPress plugin)

    WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability

    Published 1 Nov 2026 · CVE Program
  50. Critical 9.3

    CVE-2026-62048 · Bookit (WordPress plugin)

    WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability

    Published 1 Nov 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.