UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Medium 4.3

    CVE-2026-109231 · Woocommerce Germanized (WordPress plugin)

    Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change

    Published 31 Oct 2026 · CVE Program
  2. Medium 6.4

    CVE-2026-107711 · Stock Sync With Google Sheet For Woocommerce (WordPress plugin)

    FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint

    Published 31 Oct 2026 · CVE Program
  3. High 7.2

    CVE-2026-120114 · Debug Log Manager (WordPress plugin)

    Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint

    Published 31 Oct 2026 · CVE Program
  4. Medium 6.1

    CVE-2026-100151 · Ninja Forms (WordPress plugin)

    Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter

    Published 31 Oct 2026 · CVE Program
  5. High 7.5

    CVE-2026-109197 · Wpdirectorykit (WordPress plugin)

    WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter

    Published 31 Oct 2026 · CVE Program
  6. High 8.8

    CVE-2026-76010 · Nextgen Gallery (WordPress plugin)

    Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal

    Published 31 Oct 2026 · CVE Program
  7. Medium 6.4

    CVE-2026-116752 · Geodirectory (WordPress plugin)

    GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection

    Published 31 Oct 2026 · CVE Program
  8. Medium 5.3

    CVE-2026-101325 · Newsletters Lite (WordPress plugin)

    Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter

    Published 31 Oct 2026 · CVE Program
  9. High 7.2

    CVE-2026-110530 · Feedwordpress (WordPress plugin)

    FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content

    Published 31 Oct 2026 · CVE Program
  10. Critical 9.1

    CVE-2026-103882 · Acadlix (WordPress plugin)

    Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter

    Published 31 Oct 2026 · CVE Program
  11. Medium 6.4

    CVE-2026-119160 · Post Carousel (WordPress plugin)

    Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block

    Published 31 Oct 2026 · CVE Program
  12. Critical 9.8

    CVE-2026-118235 · Simple Form (WordPress plugin)

    SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data

    Published 31 Oct 2026 · CVE Program
  13. Medium 5.3

    CVE-2026-103915 · Ameliabooking (WordPress plugin)

    Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter

    Published 31 Oct 2026 · CVE Program
  14. High 8.8

    CVE-2026-120070 · WP User Frontend (WordPress plugin)

    User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter

    Published 31 Oct 2026 · CVE Program
  15. High 8.1

    CVE-2026-103898 · WP Social (WordPress plugin)

    Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback

    Published 31 Oct 2026 · CVE Program
  16. Medium 5.4

    CVE-2026-111070 · WP Content Pilot (WordPress plugin)

    Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`

    Published 31 Oct 2026 · CVE Program
  17. High 7.2

    CVE-2026-107759 · Wpo365 Msgraphmailer (WordPress plugin)

    WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail

    Published 31 Oct 2026 · CVE Program
  18. Critical 9.8

    CVE-2026-116512 · Wedevs Project Manager (WordPress plugin)

    Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection

    Published 31 Oct 2026 · CVE Program
  19. Medium 6.5

    CVE-2026-103997 · Redux Framework (WordPress plugin)

    Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript

    Published 31 Oct 2026 · CVE Program
  20. Medium 6.5

    CVE-2025-9462 · Wp2leads (WordPress plugin)

    WP2LEADS <= 3.5.6 - Authenticated (Subscriber+) SQL Injection via order Parameter

    Published 31 Oct 2026 · CVE Program
  21. Medium 6.1

    CVE-2026-103962 · WP User Frontend (WordPress plugin)

    User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter

    Published 31 Oct 2026 · CVE Program
  22. Critical 9.8

    CVE-2026-119096 · Uncanny Learndash Toolkit (WordPress plugin)

    Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter

    Published 31 Oct 2026 · CVE Program
  23. High 7.2

    CVE-2026-118057 · WP Simple Firewall (WordPress plugin)

    Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log

    Published 31 Oct 2026 · CVE Program
  24. Medium 5.9

    CVE-2026-110023 · WP Data Access (WordPress plugin)

    WP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter

    Published 31 Oct 2026 · CVE Program
  25. Medium 6.4

    CVE-2026-111592 · Publishpress Authors (WordPress plugin)

    Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name

    Published 31 Oct 2026 · CVE Program
  26. High 8.8

    CVE-2026-104012 · Rox Appointment Booking (WordPress plugin)

    Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint

    Published 31 Oct 2026 · CVE Program
  27. Medium 5.3

    CVE-2026-11396 · Woo Product Filter (WordPress plugin)

    Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter

    Published 31 Oct 2026 · CVE Program
  28. Medium 4.3

    CVE-2026-109386 · Wordpress Popup (WordPress plugin)

    Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action

    Published 31 Oct 2026 · CVE Program
  29. Medium 5.3

    CVE-2026-119166 · Usc E Shop (WordPress plugin)

    Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter

    Published 31 Oct 2026 · CVE Program
  30. High 7.2

    CVE-2026-119065 · Shipping Zones By Drawing For Woocommerce (WordPress plugin)

    Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter

    Published 31 Oct 2026 · CVE Program
  31. Medium 5.3

    CVE-2026-109217 · Woocommerce PDF Invoices Packing Slips (WordPress plugin)

    PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache

    Published 31 Oct 2026 · CVE Program
  32. High 7.2

    CVE-2026-116548 · Vikrentcar (WordPress plugin)

    VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter

    Published 31 Oct 2026 · CVE Program
  33. Medium 5.4

    CVE-2026-110251 · Woo Photo Reviews (WordPress plugin)

    Photo Reviews for WooCommerce <= 1.2.31 - Unauthenticated File Deletion via 'wcpr_image_upload_id' Parameter

    Published 31 Oct 2026 · CVE Program
  34. Critical 9.1

    CVE-2026-116557 · WP Booking System (WordPress plugin)

    WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

    Published 31 Oct 2026 · CVE Program
  35. High 7.2

    CVE-2026-118070 · Usc E Shop (WordPress plugin)

    Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter

    Published 31 Oct 2026 · CVE Program
  36. High 7.2

    CVE-2026-115840 · Vikrentcar (WordPress plugin)

    VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter

    Published 31 Oct 2026 · CVE Program
  37. High 7.2

    CVE-2026-107750 · Woocommerce PDF Invoices Packing Slips (WordPress plugin)

    PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout

    Published 31 Oct 2026 · CVE Program
  38. Medium 6.1

    CVE-2026-88942 · Woo Product Filter (WordPress plugin)

    Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter

    Published 31 Oct 2026 · CVE Program
  39. Medium 6.5

    CVE-2026-119980 · Userswp (WordPress plugin)

    UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash

    Published 31 Oct 2026 · CVE Program
  40. Medium 5.3

    CVE-2026-90960 · Seraphinite Accelerator (WordPress plugin)

    Seraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory

    Published 31 Oct 2026 · CVE Program
  41. High 7.2

    CVE-2026-119162 · User Submitted Posts (WordPress plugin)

    User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting

    Published 31 Oct 2026 · CVE Program
  42. Medium 6.4

    CVE-2026-107765 · WP Discussion Board (WordPress plugin)

    Discussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Field

    Published 31 Oct 2026 · CVE Program
  43. High 7.5

    CVE-2026-120040 · WP Mail Catcher (WordPress plugin)

    Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure

    Published 31 Oct 2026 · CVE Program
  44. Medium 6.4

    CVE-2026-116546 · WP Job Portal (WordPress plugin)

    WP Job Portal <= 2.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'degreetitle' Parameter

    Published 31 Oct 2026 · CVE Program
  45. High 7.2

    CVE-2026-116522 · Relevanssi (WordPress plugin)

    Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode

    Published 31 Oct 2026 · CVE Program
  46. High 7.2

    CVE-2026-119089 · Thirstyaffiliates (WordPress plugin)

    ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag

    Published 31 Oct 2026 · CVE Program
  47. Medium 5.4

    CVE-2026-120019 · W3 Total Cache (WordPress plugin)

    W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder

    Published 31 Oct 2026 · CVE Program
  48. High 7.2

    CVE-2026-107653 · Surecart (WordPress plugin)

    SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments

    Published 31 Oct 2026 · CVE Program
  49. High 7.5

    CVE-2026-119163 · WP Marketing Automations (WordPress plugin)

    FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter

    Published 31 Oct 2026 · CVE Program
  50. Critical 9.8

    CVE-2026-109220 · PDF For Woocommerce (WordPress plugin)

    PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field

    Published 31 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.