UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
39,342
Published in 7 days
817
Critical in 30 days
327
Actively exploited
422
Clear filters

Results for “wordpress”

2,743 vulnerabilities
  1. High 7.5

    CVE-2026-100386 · Ultimate Addons For Contact Form 7 (WordPress plugin)

    Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Arbitrary File Read via CF7 Field Value in mPDF WriteHTML SVG Parser

    Published 10 Nov 2026 · CVE Program
  2. High 8.2

    CVE-2026-120513 · Everest Forms (WordPress plugin)

    Everest Forms <= 3.6.2 - Unauthenticated Arbitrary File Deletion via 'everest_forms_{form_id}_old_{field_id}' Parameter

    Published 10 Nov 2026 · CVE Program
  3. High 7.3

    CVE-2026-120834 · Wp2leads (WordPress plugin)

    WordPress WP2LEADS plugin <= 3.5.17 - Privilege Escalation vulnerability

    Published 9 Nov 2026 · CVE Program
  4. High 8.5

    CVE-2026-121769 · WP W3all Phpbb Integration (WordPress plugin)

    WordPress WP w3all phpBB plugin <= 3.1.9 - SQL Injection vulnerability

    Published 9 Nov 2026 · CVE Program
  5. Medium 6.5

    CVE-2026-121573 · WP Security Audit Log (WordPress plugin)

    WordPress WP Activity Log plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  6. High 8.8

    CVE-2026-121576 · AI Workflow Automation AI Agent Hub (WordPress plugin)

    WordPress MCP Server for WordPress plugin <= 2.0.1 - Privilege Escalation vulnerability

    Published 9 Nov 2026 · CVE Program
  7. High 7.1

    CVE-2026-122664 · Videowhisper Live Streaming Integration (WordPress plugin)

    WordPress Broadcast Live Video plugin <= 7.3.14 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  8. High 7.1

    CVE-2026-123482 · Jetformbuilder (WordPress plugin)

    WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  9. Medium 4.3

    CVE-2026-121612 · Goodbye Captcha (WordPress plugin)

    WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.6.2 - Broken Authentication vulnerability

    Published 9 Nov 2026 · CVE Program
  10. Medium 6.5

    CVE-2026-122673 · Shopengine (WordPress plugin)

    WordPress ShopEngine plugin <= 4.9.8 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  11. High 7.5

    CVE-2026-120854 · Iubenda Cookie Law Solution (WordPress plugin)

    WordPress iubenda plugin <= 3.13.6 - Denial of Service Attack vulnerability

    Published 9 Nov 2026 · CVE Program
  12. High 7.1

    CVE-2026-120856 · Invoice Gateway For Woocommerce (WordPress plugin)

    WordPress Invoice Gateway for WooCommerce – Invoice Payment Gateway plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  13. High 7.1

    CVE-2026-123460 · WP File Upload (WordPress plugin)

    WordPress WordPress File Upload plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  14. Medium 6.5

    CVE-2026-122661 · Directorist (WordPress plugin)

    WordPress Directorist plugin <= 8.10.7 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  15. High 7.5

    CVE-2026-121722 · Forms Signature Formidable Online Contract Automation (WordPress plugin)

    WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.5 - Broken Access Control vulnerability

    Published 9 Nov 2026 · CVE Program
  16. Medium 6.5

    CVE-2026-119515 · Radius Booking (WordPress plugin)

    WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - Broken Access Control vulnerability

    Published 9 Nov 2026 · CVE Program
  17. Medium 6.5

    CVE-2026-122665 · Mangboard (WordPress plugin)

    WordPress Mang Board WP plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  18. High 7.1

    CVE-2026-122666 · Mangboard (WordPress plugin)

    WordPress Mang Board WP plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  19. Medium 6.5

    CVE-2026-119524 · Customer Area (WordPress plugin)

    WordPress WP Customer Area plugin <= 8.4.3 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  20. High 7.1

    CVE-2026-123476 · Featured Image From URL (WordPress plugin)

    WordPress Featured Image from URL plugin <= 6.1.4 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  21. Medium 6.5

    CVE-2026-120855 · Ti Woocommerce Wishlist (WordPress plugin)

    WordPress TI WooCommerce Wishlist plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  22. High 7.1

    CVE-2026-121570 · Rsvp (WordPress plugin)

    WordPress RSVP and Event Management plugin <= 2.7.17 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  23. High 7.5

    CVE-2026-123475 · Mapsvg Lite Interactive Vector Maps (WordPress plugin)

    WordPress MapSVG plugin <= 8.16.3 - Broken Access Control vulnerability

    Published 9 Nov 2026 · CVE Program
  24. High 7.1

    CVE-2026-121782 · If So (WordPress plugin)

    WordPress If-So Dynamic Content Personalization plugin <= 1.10.3 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  25. Medium 6.5

    CVE-2026-120838 · All In One Video Gallery (WordPress plugin)

    WordPress All-in-One Video Gallery plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  26. High 7.1

    CVE-2026-119483 · Form Maker (WordPress plugin)

    WordPress Form Maker by 10Web plugin <= 1.15.50 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  27. Medium 6.5

    CVE-2026-119497 · Directorist (WordPress plugin)

    WordPress Directorist plugin <= 8.10.6 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  28. High 7.1

    CVE-2026-119505 · Usc E Shop (WordPress plugin)

    WordPress Welcart e-Commerce plugin <= 2.12.6 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  29. High 7.1

    CVE-2026-123463 · Checkout Files Upload Woocommerce (WordPress plugin)

    WordPress Checkout Files Upload for WooCommerce plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  30. Medium 6.5

    CVE-2026-121763 · Hummingbird Performance (WordPress plugin)

    WordPress Hummingbird plugin <= 3.21.2 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  31. Medium 6.5

    CVE-2026-66675 · Motors Car Dealership Classified Listings (WordPress plugin)

    WordPress Motors plugin <= 1.4.128 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  32. Medium 6.3

    CVE-2026-119514 · Computer Repair Shop (WordPress plugin)

    WordPress RepairBuddy plugin <= 4.1234 - Privilege Escalation vulnerability

    Published 9 Nov 2026 · CVE Program
  33. High 7.1

    CVE-2026-123484 · Jetformbuilder (WordPress plugin)

    WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  34. High 7.1

    CVE-2026-121764 · Fv Wordpress Flowplayer (WordPress plugin)

    WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  35. High 7.1

    CVE-2026-119504 · Acf Frontend Form Element (WordPress plugin)

    WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  36. Medium 6.5

    CVE-2026-119503 · Usc E Shop (WordPress plugin)

    WordPress Welcart e-Commerce plugin <= 2.12.6 - Content Injection vulnerability

    Published 9 Nov 2026 · CVE Program
  37. High 7.1

    CVE-2026-54863 · Review Schema (WordPress plugin)

    WordPress Review Schema plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  38. High 7.5

    CVE-2026-123465 · Mycred (WordPress plugin)

    WordPress myCred plugin <= 4.0.2 - Sensitive Data Exposure vulnerability

    Published 9 Nov 2026 · CVE Program
  39. High 7.1

    CVE-2026-121780 · Nazy Load (WordPress plugin)

    WordPress Flying Images plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  40. High 7.1

    CVE-2026-111403 · WP Inventory Manager (WordPress plugin)

    WordPress WP Inventory Manager plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

    Published 9 Nov 2026 · CVE Program
  41. High 7.5

    CVE-2026-121760 · Wedocs (WordPress plugin)

    WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability

    Published 9 Nov 2026 · CVE Program
  42. Critical 9.1

    CVE-2026-119506 · Acf Frontend Form Element (WordPress plugin)

    WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Privilege Escalation vulnerability

    Published 9 Nov 2026 · CVE Program
  43. Medium 6.5

    CVE-2026-61987 · Wc Frontend Manager (WordPress plugin)

    WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.8.1 - Cross Site Scripting (XSS) vulnerability

    Published 8 Nov 2026 · CVE Program
  44. Medium 6.5

    CVE-2026-114186 · Anywhere Elementor (WordPress plugin)

    WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability

    Published 8 Nov 2026 · CVE Program
  45. High 8.5

    CVE-2026-114189 · Anywhere Elementor (WordPress plugin)

    WordPress AnyWhere Elementor plugin <= 1.3.0 - SQL Injection vulnerability

    Published 8 Nov 2026 · CVE Program
  46. Critical 9.6

    CVE-2026-109900 · Melapress Role Editor (WordPress plugin)

    WordPress Melapress Role Editor plugin <= 1.3.0 - Privilege Escalation vulnerability

    Published 8 Nov 2026 · CVE Program
  47. Medium 6.5

    CVE-2026-120858 · Fluentform (WordPress plugin)

    WordPress FluentForm plugin <= 6.2.16 - Broken Access Control vulnerability

    Published 8 Nov 2026 · CVE Program
  48. High 7.1

    CVE-2026-109899 · Melapress Role Editor (WordPress plugin)

    WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerability

    Published 8 Nov 2026 · CVE Program
  49. Medium 6.5

    CVE-2026-114188 · Anywhere Elementor (WordPress plugin)

    WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    Published 8 Nov 2026 · CVE Program
  50. Low 3.5

    CVE-2026-97195 · Secure Custom Fields (WordPress plugin)

    Secure Custom Fields: Cross-site Scripting

    Published 8 Nov 2026 · Fixed in 6.9.8 · WPVulnerability

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.