Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
36added in the last 30 days
584new WordPress flaws this week
391,288entries in the database

591 results · page 4 of 12

  • Jun 20, 2026WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by senCVE-2020-37255 · WordPress plugins & themes · reported by VulnCheckHigh 8.7

    WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWP_JSON_PREFIX header. Attackers can exploit this flaw to obtain valid administrator session cookies and access the WordPress dashboard without providing credentials.

    What to do
    Update the plugin to the newest version.
  • Jun 17, 2026Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.CVE-2026-40752 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.

    Affected
    up to 1.1.1
    What to do
    Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.CVE-2025-69164 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.

    Affected
    up to 1.10
    What to do
    Affects up to 1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Granola <= 1.13 versions.CVE-2025-69158 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Granola <= 1.13 versions.

    Affected
    up to 1.13
    What to do
    Affects up to 1.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.CVE-2025-69157 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.

    Affected
    up to 1.15
    What to do
    Affects up to 1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.CVE-2025-69144 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.

    Affected
    up to 1.10
    What to do
    Affects up to 1.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.CVE-2025-69140 · WordPress plugins & themes · reported by PatchstackHigh 7.1

    Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.

    What to do
    Update the plugin to the newest version.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.CVE-2025-69123 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.

    Affected
    up to 1.1
    What to do
    Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.CVE-2026-54184 · WordPress plugins & themes · reported by PatchstackHigh 8.2

    Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.

    Affected
    up to 1.15
    What to do
    Affects up to 1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.CVE-2026-48967 · WordPress plugins & themes · reported by PatchstackHigh 8.5

    Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions.

    Affected
    up to 1.13.19
    What to do
    Affects up to 1.13.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions.CVE-2026-40749 · WordPress plugins & themes · reported by PatchstackCritical 9.9

    Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions.

    Affected
    up to 1.1.1
    What to do
    Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.CVE-2026-27400 · WordPress plugins & themes · reported by PatchstackHigh 8.6

    Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.

    Affected
    up to 1.1.0
    What to do
    Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions.CVE-2026-22338 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions.

    Affected
    up to 1.15
    What to do
    Affects up to 1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.CVE-2025-69173 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.

    Affected
    up to 1.1
    What to do
    Affects up to 1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.CVE-2025-69161 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.

    Affected
    up to 1.13
    What to do
    Affects up to 1.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Gita <= 1.11 versions.CVE-2025-69160 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Gita <= 1.11 versions.

    Affected
    up to 1.11
    What to do
    Affects up to 1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Printo <= 1.11 versions.CVE-2025-69159 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Printo <= 1.11 versions.

    Affected
    up to 1.11
    What to do
    Affects up to 1.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Medeus <= 1.14 versions.CVE-2025-69150 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Medeus <= 1.14 versions.

    Affected
    up to 1.14
    What to do
    Affects up to 1.14. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Putter <= 1.17 versions.CVE-2025-69147 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Putter <= 1.17 versions.

    Affected
    up to 1.17
    What to do
    Affects up to 1.17. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Gat <= 1.16 versions.CVE-2025-69145 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Gat <= 1.16 versions.

    Affected
    up to 1.16
    What to do
    Affects up to 1.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions.CVE-2025-69141 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions.

    Affected
    up to 1.1.0
    What to do
    Affects up to 1.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions.CVE-2025-69121 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions.

    Affected
    up to 1.10.0
    What to do
    Affects up to 1.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.CVE-2025-69119 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.

    Affected
    up to 1.15.0
    What to do
    Affects up to 1.15.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions.CVE-2025-69117 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions.

    Affected
    up to 1.14.0
    What to do
    Affects up to 1.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.CVE-2025-69113 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.

    Affected
    up to 1.10.0
    What to do
    Affects up to 1.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.CVE-2025-69112 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.

    Affected
    up to 1.14.0
    What to do
    Affects up to 1.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.CVE-2025-69109 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.

    Affected
    up to 1.1.2
    What to do
    Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.CVE-2025-60085 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.

    Affected
    up to 1.15.0
    What to do
    Affects up to 1.15.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions.CVE-2025-58952 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions.

    What to do
    Update the plugin to the newest version.
  • Jun 17, 2026Unauthenticated Local File Inclusion in Geya <= 1.15 versions.CVE-2025-58924 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Local File Inclusion in Geya <= 1.15 versions.

    Affected
    up to 1.15
    What to do
    Affects up to 1.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 16, 2026Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.CVE-2026-54190 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.

    Affected
    up to 1.12.5
    What to do
    Affects up to 1.12.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 16, 2026Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.CVE-2026-39581 · WordPress plugins & themes · reported by PatchstackHigh 8.5

    Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.

    Affected
    up to 1.1.4
    What to do
    Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.CVE-2026-9691 · WordPress plugins & themes · reported by PatchstackCritical 9.8

    Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.

    Affected
    up to 1.1.1
    What to do
    Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.CVE-2026-49781 · WordPress plugins & themes · reported by PatchstackCritical 9.8

    Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.

    Affected
    up to 1.1.27
    What to do
    Affects up to 1.1.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.CVE-2026-49765 · WordPress plugins & themes · reported by PatchstackCritical 9.8

    Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.

    Affected
    up to 1.1.8
    What to do
    Affects up to 1.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.CVE-2026-49106 · WordPress plugins & themes · reported by PatchstackCritical 9.8

    Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.

    Affected
    up to 1.1.6
    What to do
    Affects up to 1.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.CVE-2026-49105 · WordPress plugins & themes · reported by PatchstackCritical 9.8

    Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

    Affected
    up to 1.1.4
    What to do
    Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.CVE-2026-49085 · WordPress plugins & themes · reported by PatchstackCritical 9.8

    Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

    Affected
    up to 1.1.4
    What to do
    Affects up to 1.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.CVE-2026-48881 · WordPress plugins & themes · reported by PatchstackCritical 9.1

    Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.

    Affected
    up to 1.1.9
    What to do
    Affects up to 1.1.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.CVE-2026-48870 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.

    Affected
    up to 51.1.62
    What to do
    Affects up to 51.1.62. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.CVE-2026-48867 · WordPress plugins & themes · reported by PatchstackHigh 7.1

    Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.

    Affected
    up to 11.1.2
    What to do
    Affects up to 11.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.CVE-2026-48836 · WordPress plugins & themes · reported by PatchstackCritical 10

    Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.

    Affected
    up to 2.1.19
    What to do
    Affects up to 2.1.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions.CVE-2026-48835 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions.

    Affected
    up to 1.10.0.4
    What to do
    Affects up to 1.10.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions.CVE-2026-42668 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions.

    Affected
    up to 1.18.0
    What to do
    Affects up to 1.18.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.CVE-2026-42659 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.

    Affected
    up to 1.126.12
    What to do
    Affects up to 1.126.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.CVE-2026-40762 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.

    What to do
    Update the plugin to the newest version.
  • Jun 15, 2026Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.CVE-2026-39525 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.

    Affected
    up to 1.16.48.1
    What to do
    Affects up to 1.16.48.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.CVE-2026-39502 · WordPress plugins & themes · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.

    Affected
    up to 1.15.38
    What to do
    Affects up to 1.15.38. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.CVE-2026-39480 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.

    Affected
    up to 2.1.1
    What to do
    Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.CVE-2026-39468 · WordPress plugins & themes · reported by PatchstackMedium 6.8

    Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.

    Affected
    up to 5.11.1
    What to do
    Affects up to 5.11.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.