Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
285 results · page 6 of 6
Apr 5, 2021WordPress Backup and Migrate Plugin – Backup Guard: Did not ensure that the imported files are of the SGBP format and extensionCVE-2021-24155 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.
- Product
- WordPress Backup and Migrate Plugin – Backup Guard
- Fixed in
- 1.6.0
- What to do
- Update WordPress Backup and Migrate Plugin – Backup Guard to 1.6.0 or newer.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 31, 2020An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress.CVE-2020-35950 · WordPress plugins & themes · reported by MITRECritical 9.8
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.153 for WordPress. It allows CSRF (via almost any endpoint).
- Product
- An issue was discovered in the XCloner Backup and Restore
- Fixed in
- 4.2.153
- What to do
- Update An issue was discovered in the XCloner Backup and Restore to 4.2.153 or newer.
Full record and what to do →NVD recordwpscan.comwordfence.com
Dec 31, 2020An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress.CVE-2020-35948 · WordPress plugins & themes · reported by MITRECritical 9.9
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution. The xcloner_restore.php write_file_action could overwrite wp-config.php, for example. Alternatively, an attacker could create an exploit chain to obtain a database dump.
- Product
- An issue was discovered in the XCloner Backup and Restore
- Fixed in
- 4.2.13
- What to do
- Update An issue was discovered in the XCloner Backup and Restore to 4.2.13 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 20, 2020The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/.CVE-2020-7241 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 2020_{0..1}{0..2}_{0..3}{0..9} format, guessing UNIX timestamps, and making HTTPS requests with the complete guessed URL.
- Product
- WP Database Backup
- Affected
- up to 5.5
- What to do
- Affects up to 5.5. Update WP Database Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordpress.org
Aug 13, 2019The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.CVE-2017-18488 · WordPress plugins & themes · reported by MITREMedium 6.1
The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.
- Product
- Backup Guard
- Fixed in
- 1.1.47
- What to do
- Update Backup Guard to 1.1.47 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 12, 2019The wp-database-backup plugin before 5.1.2 for WordPress has XSS.CVE-2019-14949 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-database-backup plugin before 5.1.2 for WordPress has XSS.
- Product
- wp-database-backup
- Fixed in
- 5.1.2
- What to do
- Update wp-database-backup to 5.1.2 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 12, 2019The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.CVE-2016-10876 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.
- Product
- wp-database-backup
- Fixed in
- 4.3.1
- What to do
- Update wp-database-backup to 4.3.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 12, 2019The wp-database-backup plugin before 4.3.1 for WordPress has XSS.CVE-2016-10875 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-database-backup plugin before 4.3.1 for WordPress has XSS.
- Product
- wp-database-backup
- Fixed in
- 4.3.1
- What to do
- Update wp-database-backup to 4.3.1 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 12, 2019The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.CVE-2016-10874 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.
- Product
- wp-database-backup
- Fixed in
- 4.3.3
- What to do
- Update wp-database-backup to 4.3.3 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 12, 2019The wp-database-backup plugin before 4.3.3 for WordPress has XSS.CVE-2016-10873 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-database-backup plugin before 4.3.3 for WordPress has XSS.
- Product
- wp-database-backup
- Fixed in
- 4.3.3
- What to do
- Update wp-database-backup to 4.3.3 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
May 7, 2019The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files,CVE-2018-19456 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files, as demonstrated by download.sql.
- Product
- WP Backup+ (aka WPbackupplus)
- Affected
- up to 2018-11-22
- What to do
- Affects up to 2018-11-22. Update WP Backup+ (aka WPbackupplus) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlists.opensuse.orgeasyhack.in
Oct 5, 2018The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archCVE-2014-10076 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archives via a brute-force attack.
- Affected
- 2.2.4 to 2.2.4
- What to do
- Affects 2.2.4 to 2.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comvapidlabs.com
Apr 10, 2018The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd paCVE-2014-3114 · WordPress plugins & themes · reported by MITRECritical 9.8
The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via the cmd parameter to functions/ezpz-archive-cmd.php.
- Affected
- up to 12.03.10
- What to do
- Affects up to 12.03.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordopenwall.comopenwall.com
Nov 14, 2017installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values "url_new" (/wp-contCVE-2017-16815 · WordPress plugins & themes · reported by MITREMedium 6.1
installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) plugin before 1.2.30 for WordPress has XSS because the values "url_new" (/wp-content/plugins/duplicator/installer/build/view.step4.php) and "logging" (wp-content/plugins/duplicator/installer/build/view.step2.php) are not filtered correctly.
- Product
- installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup)
- Fixed in
- 1.2.30
- What to do
- Update installer.php in the Snap Creek Duplicator (WordPress Site Migration & Backup) to 1.2.30 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comsnapcreek.com
Sep 27, 2017Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.CVE-2017-2551 · WordPress plugins & themes · reported by larry0@me.comHigh 7.5
Vulnerability in Wordpress plugin BackWPup before v3.4.2 allows possible brute forcing of backup file for download.
- Affected
- up to 3.4.1
- What to do
- Affects up to 3.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Sep 14, 2017Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that CVE-2017-1002016 · WordPress plugins & themes · reported by larry0@me.comCritical 9.8
Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files.
- Affected
- 0.7 to 0.7
- What to do
- Affects 0.7 to 0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comwordpress.org
Sep 12, 2017In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticaCVE-2015-9230 · WordPress plugins & themes · reported by MITREMedium 4.8
In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticated administrators via the DBTablePrefix parameter.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordopenwall.comcxsecurity.com
Aug 28, 2017BackupGuard prior to version 1.1.47: Cross-site scriptingCVE-2017-10837 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.
- Product
- BackupGuard prior to version 1.1.47
- Affected
- up to 1.1.46
- What to do
- Affects up to 1.1.46. Update BackupGuard prior to version 1.1.47 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 7, 2017The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files.CVE-2014-9262 · WordPress plugins & themes · reported by MITREHigh 8.2
The Duplicator plugin in Wordpress before 0.5.10 allows remote authenticated users to create and download backup files.
- Fixed in
- 0.5.10
- What to do
- Update the plugin to 0.5.10 or newer.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jun 7, 2017Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress.CVE-2014-9310 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress.
- Product
- Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox
- Fixed in
- 4.1
- What to do
- Update Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox to 4.1 or newer.
Full record and what to do →NVD recordsecurityfocus.comsecurity.szurek.pl
Oct 6, 2016Remote file download vulnerability in recent-backups v0.7 wordpress pluginCVE-2015-1000006 · WordPress plugins & themes · reported by MITREHigh 7.5
Remote file download vulnerability in recent-backups v0.7 wordpress plugin
- Affected
- 0.7 to 0.7
- What to do
- Affects 0.7 to 0.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Jun 10, 2015The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access conCVE-2014-8605 · WordPress plugins & themes · reported by MITREMedium 5
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to a backup file in administrators/backups/.
- Affected
- 3.1.1 to 3.1.1
- What to do
- Affects 3.1.1 to 3.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapid.dhs.orgvapid.dhs.org
Dec 31, 2014Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote attackers to read arbitrary files via a ..CVE-2014-9119 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
- Product
- DB Backup
- Affected
- up to 4.5
- What to do
- Affects up to 4.5. Update DB Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordseclists.orgexchange.xforce.ibmcloud.com
Nov 3, 2014Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 CVE-2014-7228 · WordPress plugins & themes · reported by MITREHigh 7.5
Akeeba Restore (restore.php), as used in Joomla! 2.5.4 through 2.5.25, 3.x through 3.2.5, and 3.3.0 through 3.3.4; Akeeba Backup for Joomla! Professional 3.0.0 through 4.0.2; Backup Professional for WordPress 1.0.b1 through 1.1.3; Solo 1.0.b1 through 1.1.2; Admin Tools Core and Professional 2.0.0 through 2.4.4; and CMS Update 1.0.a1 through 1.0.1, when performing a backup or update for an archive, does not delete parameters from $_GET and $_POST when it is cleansing $_REQUEST, but later accesses $_GET and $_POST using the getQueryParam function, which allows remote attackers to bypass encryption and execute arbitrary code via a command message that extracts a crafted archive.
- Affected
- up to 2.5.25
- What to do
- Affects up to 2.5.25. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddeveloper.joomla.orgwebsec.wordpress.com
Apr 2, 2013importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which caCVE-2013-2744 · WordPress plugins & themes · reported by MITREMedium 5
importbuddy.php in the BackupBuddy plugin 2.2.25 for WordPress allows remote attackers to obtain configuration information via a step 0 phpinfo action, which calls the phpinfo function.
- Product
- BackupBuddy
- What to do
- Update BackupBuddy to the newest version.
Full record and what to do →NVD recordarchives.neohapsis.compacketstormsecurity.com
Apr 2, 2013importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted iCVE-2013-2743 · WordPress plugins & themes · reported by MITREHigh 7.5
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress allows remote attackers to bypass authentication via a crafted integer in the step parameter.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordarchives.neohapsis.compacketstormsecurity.com
Apr 2, 2013importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operaCVE-2013-2742 · WordPress plugins & themes · reported by MITREHigh 7.5
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operation, which makes it easier for remote attackers to obtain access via subsequent requests to this script.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordarchives.neohapsis.compacketstormsecurity.com
Apr 2, 2013importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows reCVE-2013-2741 · WordPress plugins & themes · reported by MITREHigh 7.5
importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not require that authentication be enabled, which allows remote attackers to obtain sensitive information, or overwrite or delete files, via vectors involving a (1) direct request, (2) step=1 request, (3) step=2 or step=3 request, or (4) step=7 request.
- What to do
- Update the plugin to the newest version.
Full record and what to do →NVD recordarchives.neohapsis.compacketstormsecurity.com
Feb 12, 2013Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup plugin before 0.2.2 for WordPress allows remote attackers to inject arbitraCVE-2011-5264 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup plugin before 0.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xml_or_all parameter.
- Product
- Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup
- Fixed in
- 0.2.2
- What to do
- Update Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup to 0.2.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com
Jan 20, 2012Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-0898 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dwn_file parameter.
- Product
- myEASYbackup
- What to do
- Update myEASYbackup to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Jan 9, 2008wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x,: Cross-site scripting (XSS)CVE-2008-0193 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, allows remote attackers to inject arbitrary web script or HTML via the backup parameter in a wp-db-backup.php action to wp-admin/edit.php.
- Product
- wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x,
- Affected
- up to 2.3.x
- What to do
- Affects up to 2.3.x. Update wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x through 2.3.x, to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlists.grok.org.uksecunia.com
Jan 9, 2008wp-db-backup.php in WordPress 2.0.3 and earlier: Directory traversalCVE-2008-0194 · WordPress plugins & themes · reported by MITREHigh 7.5
Directory traversal vulnerability in wp-db-backup.php in WordPress 2.0.3 and earlier allows remote attackers to read arbitrary files, delete arbitrary files, and cause a denial of service via a .. (dot dot) in the backup parameter in a wp-db-backup.php action to wp-admin/edit.php. NOTE: this might be the same as CVE-2006-5705.1.
- Product
- wp-db-backup.php in WordPress 2.0.3 and earlier
- Affected
- up to 2.0.3
- What to do
- Affects up to 2.0.3. Update wp-db-backup.php in WordPress 2.0.3 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlists.grok.org.uksecunia.com
Nov 2, 2007Multiple PHP remote file inclusion vulnerabilities in the BackUpWordPress 0.4.2b and earlier plugin for WordPress allow remote attackers to execute arbitrary PHCVE-2007-5800 · WordPress plugins & themes · reported by MITREMedium 6.8
Multiple PHP remote file inclusion vulnerabilities in the BackUpWordPress 0.4.2b and earlier plugin for WordPress allow remote attackers to execute arbitrary PHP code via a URL in the bkpwp_plugin_path parameter to (1) plugins/BackUp/Archive.php; and (2) Predicate.php, (3) Writer.php, (4) Reader.php, and other unspecified scripts under plugins/BackUp/Archive/.
- Affected
- up to 0.4.2b
- What to do
- Affects up to 0.4.2b. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 3, 2006Multiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0.5 allow remote authenticated users to read or overwrite arbitraCVE-2006-5705 · WordPress plugins & themes · reported by MITREMedium 6
Multiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0.5 allow remote authenticated users to read or overwrite arbitrary files via directory traversal sequences in the (1) backup and (2) fragment parameters in a GET request.
- Fixed in
- 2.0.5
- What to do
- Update the plugin to 2.0.5 or newer.
Full record and what to do →NVD recordbugs.gentoo.orgmarkjaquith.wordpress.com
Aug 17, 2006wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier: Directory traversalCVE-2006-4208 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier allows remote authenticated users with administrative privileges to read arbitrary files via a .. (dot dot) in the backup parameter to edit.php.
- Product
- wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.