Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list
35added in the last 30 days
479new WordPress flaws this week
390,525entries in the database

520 results · page 4 of 11

  • Aug 18, 2026Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.CVE-2026-73399 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.

    Affected
    up to 3.3.0
    What to do
    Affects up to 3.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 18, 2026Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.CVE-2026-73398 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.

    What to do
    Update the plugin to the newest version.
  • Aug 18, 2026Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.CVE-2026-73396 · WordPress plugins & themes · reported by PatchstackHigh 7.1

    Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.

    Affected
    up to 1.6.7
    What to do
    Affects up to 1.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 18, 2026Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.CVE-2026-73381 · WordPress plugins & themes · reported by PatchstackCritical 9.1

    Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

    Affected
    up to 1.13.0
    What to do
    Affects up to 1.13.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 18, 2026Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.CVE-2026-73377 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

    What to do
    Update the plugin to the newest version.
  • Aug 18, 2026Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.CVE-2026-73352 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.

    Affected
    up to 4.16.5.1
    What to do
    Affects up to 4.16.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 18, 2026Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.CVE-2026-73350 · WordPress plugins & themes · reported by PatchstackHigh 8.2

    Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.

    Affected
    up to 3.5.1
    What to do
    Affects up to 3.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 18, 2026Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.CVE-2026-73348 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

    What to do
    Update the plugin to the newest version.
  • Aug 18, 2026Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.CVE-2026-66679 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.

    Affected
    up to 1.5.91
    What to do
    Affects up to 1.5.91. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 18, 2026Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.CVE-2026-32549 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.

    What to do
    Update the plugin to the newest version.
  • Aug 18, 2026Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.CVE-2026-32481 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.

    Affected
    up to 2.22.11
    What to do
    Affects up to 2.22.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 18, 2026Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.CVE-2026-32472 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.

    Affected
    up to 1.3.0
    What to do
    Affects up to 1.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 18, 2026Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.CVE-2026-28571 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.

    Affected
    up to 2.15.7
    What to do
    Affects up to 2.15.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 18, 2026Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.CVE-2026-28567 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.

    Affected
    up to 1.3.5
    What to do
    Affects up to 1.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.CVE-2026-73403 · WordPress plugins & themes · reported by PatchstackMedium 5.3

    Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.

    Affected
    up to 5.2.6
    What to do
    Affects up to 5.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.CVE-2026-73401 · WordPress plugins & themes · reported by PatchstackMedium 5.3

    Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.

    Affected
    up to 0.1.3.7
    What to do
    Affects up to 0.1.3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.CVE-2026-73353 · WordPress plugins & themes · reported by PatchstackMedium 5.3

    Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.

    What to do
    Update the plugin to the newest version.
  • Aug 13, 2026Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.CVE-2026-73349 · WordPress plugins & themes · reported by PatchstackMedium 5.3

    Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

    What to do
    Update the plugin to the newest version.
  • Aug 13, 2026Subscriber Broken Access Control in Motors <= 1.4.113 versions.CVE-2026-66693 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Subscriber Broken Access Control in Motors <= 1.4.113 versions.

    Affected
    up to 1.4.113
    What to do
    Affects up to 1.4.113. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.CVE-2026-66691 · WordPress plugins & themes · reported by PatchstackCritical 9.8

    Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.

    Affected
    up to 1.6.6
    What to do
    Affects up to 1.6.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in Anti Spam and list cleaner &#8211; AcyChecker <= 2.0.0 versions.CVE-2026-66689 · WordPress plugins & themes · reported by PatchstackMedium 6.3

    Unauthenticated Broken Access Control in Anti Spam and list cleaner &#8211; AcyChecker <= 2.0.0 versions.

    Affected
    up to 2.0.0
    What to do
    Affects up to 2.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.CVE-2026-66660 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.

    Affected
    up to 2.5.1
    What to do
    Affects up to 2.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.CVE-2026-66469 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.

    Affected
    up to 1.5.3
    What to do
    Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versiCVE-2026-66466 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.

    Affected
    up to 2.1.1
    What to do
    Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.CVE-2026-66465 · WordPress plugins & themes · reported by PatchstackCritical 9.8

    Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.

    Affected
    up to 1.3.0.1
    What to do
    Affects up to 1.3.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.CVE-2026-66464 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.

    Affected
    up to 5.2.7
    What to do
    Affects up to 5.2.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.CVE-2026-66461 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.

    Affected
    up to 1.0.5
    What to do
    Affects up to 1.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.CVE-2026-66459 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.

    Affected
    up to 2.4.2
    What to do
    Affects up to 2.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.CVE-2026-66455 · WordPress plugins & themes · reported by PatchstackMedium 6

    Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.

    Affected
    up to 3.4.0
    What to do
    Affects up to 3.4.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.CVE-2026-66454 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.

    Affected
    up to 1.5
    What to do
    Affects up to 1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.CVE-2026-66453 · WordPress plugins & themes · reported by PatchstackCritical 9.8

    Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.

    Affected
    up to 10.30.26
    What to do
    Affects up to 10.30.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.CVE-2026-66441 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.

    Affected
    up to 5.0.10
    What to do
    Affects up to 5.0.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.CVE-2026-66431 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.

    Affected
    up to 1.0.7
    What to do
    Affects up to 1.0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.CVE-2026-61984 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

    Affected
    up to 11.77
    What to do
    Affects up to 11.77. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.CVE-2026-61978 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.

    Affected
    up to 1.0.32
    What to do
    Affects up to 1.0.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.CVE-2026-28188 · WordPress plugins & themes · reported by PatchstackHigh 7.3

    Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.

    Affected
    up to 1.2.2
    What to do
    Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.CVE-2026-28186 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

    Affected
    up to 1.5.1
    What to do
    Affects up to 1.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.CVE-2026-28185 · WordPress plugins & themes · reported by PatchstackCritical 9.8

    Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.

    Affected
    up to 1.4.2
    What to do
    Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.CVE-2026-28181 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.

    Affected
    up to 10.11.1
    What to do
    Affects up to 10.11.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.CVE-2026-28159 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.

    Affected
    up to 6.2
    What to do
    Affects up to 6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.CVE-2026-28008 · WordPress plugins & themes · reported by PatchstackCritical 9.8

    Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

    Affected
    up to 7.0.0
    What to do
    Affects up to 7.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.CVE-2026-27999 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.

    Affected
    up to 2.23.1
    What to do
    Affects up to 2.23.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.CVE-2026-27535 · WordPress plugins & themes · reported by PatchstackHigh 7.1

    Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

    Affected
    up to 1.6.0
    What to do
    Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 13, 2026Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.CVE-2026-27345 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

    Affected
    up to 2.0.3
    What to do
    Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 10, 2026vitepos WordPress plugin before 3.6.0, Vitepos: Do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability bCVE-2026-14237 · WordPress plugins & themes · reported by WPScanHigh 7.2

    The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.

    Product
    vitepos WordPress plugin before 3.6.0, Vitepos
    Fixed in
    3.6.0
    What to do
    Update vitepos WordPress plugin before 3.6.0, Vitepos to 3.6.0 or newer.
  • Aug 6, 2026Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.CVE-2026-66712 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.

    Affected
    up to 4.7.8
    What to do
    Affects up to 4.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 6, 2026Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.CVE-2026-66708 · WordPress plugins & themes · reported by PatchstackHigh 8.2

    Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.

    Affected
    up to 1.17.2
    What to do
    Affects up to 1.17.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 6, 2026Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.CVE-2026-66701 · WordPress plugins & themes · reported by PatchstackMedium 5.3

    Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.

    Affected
    up to 3.16.5
    What to do
    Affects up to 3.16.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 6, 2026Custom role Broken Access Control in Dokan <= 5.0.10 versions.CVE-2026-66699 · WordPress plugins & themes · reported by PatchstackMedium 5.3

    Custom role Broken Access Control in Dokan <= 5.0.10 versions.

    Affected
    up to 5.0.10
    What to do
    Affects up to 5.0.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Aug 6, 2026Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.CVE-2026-66678 · WordPress plugins & themes · reported by PatchstackMedium 4.3

    Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.

    Affected
    up to 6.1.1
    What to do
    Affects up to 6.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.