UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
813
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. Critical 9.1

    CVE-2026-89270 · Popup Builder (WordPress plugin)

    Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters

    Published 31 Oct 2026 · CVE Program
  2. Medium 6.1

    CVE-2026-111109 · Webmention (WordPress plugin)

    Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag

    Published 31 Oct 2026 · CVE Program
  3. High 7.2

    CVE-2026-111254 · W3 Total Cache (WordPress plugin)

    W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry

    Published 31 Oct 2026 · CVE Program
  4. High 7.2

    CVE-2026-116520 · Password Protect Page (WordPress plugin)

    PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision

    Published 31 Oct 2026 · CVE Program
  5. Medium 6.5

    CVE-2026-100155 · Ninja Forms (WordPress plugin)

    Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag

    Published 31 Oct 2026 · CVE Program
  6. Medium 6.5

    CVE-2026-92294 · Ultimate Addons For Gutenberg (WordPress plugin)

    Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters

    Published 31 Oct 2026 · CVE Program
  7. High 7.2

    CVE-2026-109997 · Ninja Forms (WordPress plugin)

    Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization

    Published 31 Oct 2026 · CVE Program
  8. High 8.1Actively exploited

    CVE-2026-119977 · WordPress

    WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

    Published 31 Oct 2026 · Fixed in 6.9.11, 7.0.8, 7.1.4 · NVD, CVE Program
  9. High 7.2

    CVE-2026-109234 · Meow Lightbox (WordPress plugin)

    Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization

    Published 31 Oct 2026 · CVE Program
  10. Medium 5.4

    CVE-2026-116563 · Nextgen Gallery (WordPress plugin)

    Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML

    Published 31 Oct 2026 · CVE Program
  11. Medium 5.4

    CVE-2026-101326 · Ninja Forms (WordPress plugin)

    Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name

    Published 31 Oct 2026 · CVE Program
  12. High 8.8

    CVE-2026-118090 · Masterstudy Lms Learning Management System (WordPress plugin)

    WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability

    Published 30 Oct 2026 · CVE Program
  13. High 7.2

    CVE-2026-118089 · Best Woocommerce Feed (WordPress plugin)

    WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability

    Published 30 Oct 2026 · CVE Program
  14. High 8.8

    CVE-2026-118086 · WP Base Booking Of Appointments Services And Events (WordPress plugin)

    WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability

    Published 30 Oct 2026 · CVE Program
  15. High 7.5

    CVE-2026-116862 · WP Rest Cache (WordPress plugin)

    WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  16. High 7.5

    CVE-2026-116861 · Flexible Chat (WordPress plugin)

    WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

    Published 30 Oct 2026 · CVE Program
  17. Medium 6.5

    CVE-2026-116854 · Customer Area (WordPress plugin)

    WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  18. Medium 6.5

    CVE-2026-116853 · Give (WordPress plugin)

    WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  19. Critical 9.1

    CVE-2026-116852 · Widget Options (WordPress plugin)

    WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability

    Published 30 Oct 2026 · CVE Program
  20. High 7.1

    CVE-2026-116851 · Ecommerce Product Catalog (WordPress plugin)

    WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  21. High 7.1

    CVE-2026-116847 · Mangboard (WordPress plugin)

    WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  22. Medium 6.5

    CVE-2026-116410 · Learning Management System (WordPress plugin)

    WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability

    Published 30 Oct 2026 · CVE Program
  23. High 7.1

    CVE-2026-116405 · Vikrentcar (WordPress plugin)

    WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  24. High 7.5

    CVE-2026-116401 · Woocommerce Products Filter (WordPress plugin)

    WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  25. Critical 9.8

    CVE-2026-116386 · SMS Alert (WordPress plugin)

    WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability

    Published 30 Oct 2026 · CVE Program
  26. Medium 6.5

    CVE-2026-115947 · Woocommerce Products Filter (WordPress plugin)

    WordPress HUSKY plugin <= 1.4.6 - Sensitive Data Exposure vulnerability

    Published 30 Oct 2026 · CVE Program
  27. Medium 5.0

    CVE-2026-115604 · Suredash (WordPress plugin)

    WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerability

    Published 30 Oct 2026 · CVE Program
  28. Medium 6.5

    CVE-2026-114711 · Dc Woocommerce Multi Vendor (WordPress plugin)

    WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  29. Medium 5.3

    CVE-2026-107868 · Yith Woocommerce Product Add Ons (WordPress plugin)

    WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerability

    Published 30 Oct 2026 · CVE Program
  30. High 7.1

    CVE-2026-105077 · Ad Inserter (WordPress plugin)

    WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  31. High 7.1

    CVE-2026-94175 · Change WP Admin Login (WordPress plugin)

    WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  32. Critical 9.8

    CVE-2026-90888 · Leadsnap (WordPress plugin)

    WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability

    Published 30 Oct 2026 · CVE Program
  33. High 8.8

    CVE-2026-78527 · Gs Testimonial (WordPress plugin)

    WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability

    Published 30 Oct 2026 · CVE Program
  34. High 8.8

    CVE-2026-73186 · Enable Media Replace (WordPress plugin)

    WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability

    Published 30 Oct 2026 · CVE Program
  35. High 7.1

    CVE-2026-54855 · Profile Builder (WordPress plugin)

    WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  36. Medium 6.3

    CVE-2026-54854 · Profile Builder (WordPress plugin)

    WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability

    Published 30 Oct 2026 · CVE Program
  37. Medium 6.5

    CVE-2026-54850 · Booking And Rental Manager For Woocommerce (WordPress plugin)

    WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  38. High 7.1

    CVE-2026-48201 · Fast Velocity Minify (WordPress plugin)

    WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  39. High 7.1

    CVE-2026-39786 · Ba Book Everything (WordPress plugin)

    WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  40. Critical 9.8

    CVE-2026-39738 · WP Marketing Automations (WordPress plugin)

    WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability

    Published 30 Oct 2026 · CVE Program
  41. High 7.5

    CVE-2026-39734 · WP Easy Pay (WordPress plugin)

    WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability

    Published 30 Oct 2026 · CVE Program
  42. Critical 9.3

    CVE-2026-39732 · Serbian Transliteration (WordPress plugin)

    WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability

    Published 30 Oct 2026 · CVE Program
  43. High 7.1

    CVE-2026-28160 · Vikrentcar (WordPress plugin)

    WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  44. Medium 6.5

    CVE-2026-27061 · User Registration (WordPress plugin)

    WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability

    Published 30 Oct 2026 · CVE Program
  45. Critical 9.8

    CVE-2026-119526 · Royal Event (WordPress theme)

    WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability

    Published 30 Oct 2026 · CVE Program
  46. Medium 5.3

    CVE-2026-62056 · Fluent Crm (WordPress plugin)

    WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  47. Medium 4.3

    CVE-2026-62023 · Unlimited Elements For Elementor (WordPress plugin)

    WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  48. Medium 4.3

    CVE-2026-62019 · Bookit (WordPress plugin)

    WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  49. Medium 4.3

    CVE-2026-104674 · Booktics (WordPress plugin)

    WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program
  50. Medium 4.3

    CVE-2026-62047 · Event Tickets (WordPress plugin)

    WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability

    Published 30 Oct 2026 · CVE Program

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.