Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

542new WordPress flaws this week

391,528entries in the database

4,893 results · page 67 of 98

Aug 27, 2019The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.CVE-2015-9348 · WordPress plugins & themes · reported by MITREHigh 7.5
The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.
Product
sell-downloads
Fixed in
1.0.8
What to do
Update sell-downloads to 1.0.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.CVE-2019-15659 · WordPress plugins & themes · reported by MITRECritical 9.8
The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.
Product
pie-register
Fixed in
3.1.2
What to do
Update pie-register to 3.1.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.CVE-2019-15649 · WordPress plugins & themes · reported by MITREHigh 8.8
The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.
Product
insert-or-embed-articulate-content-into-wordpress
Fixed in
4.2999
What to do
Update insert-or-embed-articulate-content-into-wordpress to 4.2999 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.CVE-2019-15648 · WordPress plugins & themes · reported by MITREMedium 6.5
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.
Product
insert-or-embed-articulate-content-into-wordpress
Fixed in
4.29991
What to do
Update insert-or-embed-articulate-content-into-wordpress to 4.29991 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.CVE-2019-15647 · WordPress plugins & themes · reported by MITREHigh 8.8
The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.
Product
groundhogg
Fixed in
1.3.5
What to do
Update groundhogg to 1.3.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The rsvpmaker plugin before 6.2 for WordPress has SQL injection.CVE-2019-15646 · WordPress plugins & themes · reported by MITRECritical 9.8
The rsvpmaker plugin before 6.2 for WordPress has SQL injection.
Product
rsvpmaker
Fixed in
6.2
What to do
Update rsvpmaker to 6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 27, 2019The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.CVE-2019-15645 · WordPress plugins & themes · reported by MITREHigh 8.8
The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.
Product
zoho-salesiq
Fixed in
1.0.9
What to do
Update zoho-salesiq to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.CVE-2019-15644 · WordPress plugins & themes · reported by MITREMedium 6.1
The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.
Product
zoho-salesiq
Fixed in
1.0.9
What to do
Update zoho-salesiq to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.CVE-2019-15643 · WordPress plugins & themes · reported by MITREMedium 6.1
The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.
Product
ultimate-faqs
Fixed in
1.8.22
What to do
Update ultimate-faqs to 1.8.22 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.CVE-2018-21006 · WordPress plugins & themes · reported by MITREHigh 8.8
The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.
Product
bbp-move-topics
Fixed in
1.1.6
What to do
Update bbp-move-topics to 1.1.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The bbp-move-topics plugin before 1.1.6 for WordPress has code injection.CVE-2018-21005 · WordPress plugins & themes · reported by MITRECritical 9.8
The bbp-move-topics plugin before 1.1.6 for WordPress has code injection.
Product
bbp-move-topics
Fixed in
1.1.6
What to do
Update bbp-move-topics to 1.1.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection.CVE-2018-21004 · WordPress plugins & themes · reported by MITRECritical 9.8
The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection.
Product
rsvpmaker
Fixed in
5.6.4
What to do
Update rsvpmaker to 5.6.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 27, 2019The buddyforms plugin before 2.2.8 for WordPress has SQL injection.CVE-2018-21003 · WordPress plugins & themes · reported by MITRECritical 9.8
The buddyforms plugin before 2.2.8 for WordPress has SQL injection.
Product
buddyforms
Fixed in
2.2.8
What to do
Update buddyforms to 2.2.8 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.CVE-2018-21002 · WordPress plugins & themes · reported by MITREHigh 8.8
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.
Product
js-support-ticket
Fixed in
2.0.6
What to do
Update js-support-ticket to 2.0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The anycomment plugin before 0.0.33 for WordPress has XSS.CVE-2018-21001 · WordPress plugins & themes · reported by MITREMedium 6.1
The anycomment plugin before 0.0.33 for WordPress has XSS.
Product
anycomment
Fixed in
0.0.33
What to do
Update anycomment to 0.0.33 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.CVE-2017-18590 · WordPress plugins & themes · reported by MITREMedium 6.1
The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
Product
timesheet
Fixed in
0.1.5
What to do
Update timesheet to 0.1.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.CVE-2016-10935 · WordPress plugins & themes · reported by MITRECritical 9.8
The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.
Product
woocommerce-exporter
Fixed in
1.8.4
What to do
Update woocommerce-exporter to 1.8.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The check-email plugin before 0.5.2 for WordPress has XSS.CVE-2016-10934 · WordPress plugins & themes · reported by MITREMedium 6.1
The check-email plugin before 0.5.2 for WordPress has XSS.
Product
check-email
Fixed in
0.5.2
What to do
Update check-email to 0.5.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.CVE-2015-9349 · WordPress plugins & themes · reported by MITREMedium 6.1
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.
Product
ckeditor-for-wordpress
Fixed in
4.5.3.1
What to do
Update ckeditor-for-wordpress to 4.5.3.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.CVE-2015-9347 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.
Product
wp-plotly
Fixed in
1.0.3
What to do
Update wp-plotly to 1.0.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The cp-polls plugin before 1.0.5 for WordPress has XSS.CVE-2015-9346 · WordPress plugins & themes · reported by MITREMedium 6.1
The cp-polls plugin before 1.0.5 for WordPress has XSS.
Product
cp-polls
Fixed in
1.0.5
What to do
Update cp-polls to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.CVE-2015-9345 · WordPress plugins & themes · reported by MITREHigh 7.5
The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.
Product
link-log
Fixed in
2.0
What to do
Update link-log to 2.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The link-log plugin before 2.1 for WordPress has SQL injection.CVE-2015-9344 · WordPress plugins & themes · reported by MITRECritical 9.8
The link-log plugin before 2.1 for WordPress has SQL injection.
Product
link-log
Fixed in
2.1
What to do
Update link-log to 2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The wp-rollback plugin before 1.2.3 for WordPress has CSRF.CVE-2015-9343 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-rollback plugin before 1.2.3 for WordPress has CSRF.
Product
wp-rollback
Fixed in
1.2.3
What to do
Update wp-rollback to 1.2.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The wp-rollback plugin before 1.2.3 for WordPress has XSS.CVE-2015-9342 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-rollback plugin before 1.2.3 for WordPress has XSS.
Product
wp-rollback
Fixed in
1.2.3
What to do
Update wp-rollback to 1.2.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.CVE-2014-10395 · WordPress plugins & themes · reported by MITREMedium 6.1
The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.
Product
cp-polls
Fixed in
1.0.1
What to do
Update cp-polls to 1.0.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 23, 2019The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name,CVE-2019-15092 · WordPress plugins & themes · reported by MITREHigh 7.3
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com hackpuntes.com
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.CVE-2019-15329 · WordPress plugins & themes · reported by MITREHigh 8.8
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.
Product
import-users-from-csv-with-meta
Fixed in
1.14.0.3
What to do
Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.CVE-2019-15328 · WordPress plugins & themes · reported by MITREMedium 6.1
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.
Product
import-users-from-csv-with-meta
Fixed in
1.14.0.3
What to do
Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.CVE-2019-15327 · WordPress plugins & themes · reported by MITREMedium 6.1
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.
Product
import-users-from-csv-with-meta
Fixed in
1.14.1.3
What to do
Update import-users-from-csv-with-meta to 1.14.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.CVE-2019-15326 · WordPress plugins & themes · reported by MITREHigh 7.5
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.
Product
import-users-from-csv-with-meta
Fixed in
1.14.2.1
What to do
Update import-users-from-csv-with-meta to 1.14.2.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.CVE-2018-20987 · WordPress plugins & themes · reported by MITRECritical 9.8
The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.
Product
newsletters-lite
Fixed in
4.6.8.6
What to do
Update newsletters-lite to 4.6.8.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.CVE-2018-20986 · WordPress plugins & themes · reported by MITREMedium 5.4
The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.
Product
advanced-custom-fields (aka Elliot Condon Advanced Custom Fields)
Fixed in
5.7.8
What to do
Update advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) to 5.7.8 or newer.
Full record and what to do →NVD record wordpress.org advancedcustomfields.com
Aug 22, 2019The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.CVE-2017-18585 · WordPress plugins & themes · reported by MITREHigh 8.1
The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.
Product
posts-in-page
Fixed in
1.3.0
What to do
Update posts-in-page to 1.3.0 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 22, 2019The corner-ad plugin before 1.0.8 for WordPress has XSS.CVE-2017-18579 · WordPress plugins & themes · reported by MITREMedium 6.1
The corner-ad plugin before 1.0.8 for WordPress has XSS.
Product
corner-ad
Fixed in
1.0.8
What to do
Update corner-ad to 1.0.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.CVE-2017-18578 · WordPress plugins & themes · reported by MITREMedium 6.1
The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.
Product
crafty-social-buttons
Fixed in
1.5.8
What to do
Update crafty-social-buttons to 1.5.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.CVE-2016-10929 · WordPress plugins & themes · reported by MITREMedium 5.3
The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.
Product
advanced-ajax-page-loader
Fixed in
2.7.7
What to do
Update advanced-ajax-page-loader to 2.7.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.CVE-2016-10928 · WordPress plugins & themes · reported by MITREHigh 7.5
The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
Product
onelogin-saml-sso
Fixed in
2.2.0
What to do
Update onelogin-saml-sso to 2.2.0 or newer.
Full record and what to do →NVD record github.com wordpress.org
Aug 22, 2019The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess fCVE-2015-9340 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.
Product
wp-file-upload
Fixed in
3.0.0
What to do
Update wp-file-upload to 3.0.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.CVE-2015-9339 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.
Product
wp-file-upload
Fixed in
2.7.1
What to do
Update wp-file-upload to 2.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.CVE-2015-9338 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.
Product
wp-file-upload
Fixed in
2.5.0
What to do
Update wp-file-upload to 2.5.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The email-newsletter plugin through 20.15 for WordPress has SQL injection.CVE-2015-9334 · WordPress plugins & themes · reported by MITRECritical 9.8
The email-newsletter plugin through 20.15 for WordPress has SQL injection.
Product
email-newsletter
Affected
up to 20.15
What to do
Affects up to 20.15. Update email-newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The cforms2 plugin before 10.5 for WordPress has XSS.CVE-2014-10393 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 10.5 for WordPress has XSS.
Product
cforms2
Fixed in
10.5
What to do
Update cforms2 to 10.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.CVE-2014-10386 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.
Product
wp-live-chat-support
Fixed in
4.1.0
What to do
Update wp-live-chat-support to 4.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.CVE-2014-10382 · WordPress plugins & themes · reported by MITREMedium 4.3
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.
Product
feature-comments
Fixed in
1.2.5
What to do
Update feature-comments to 1.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion.CVE-2013-7483 · WordPress plugins & themes · reported by MITRECritical 9.8
The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion.
Product
slidedeck2
Fixed in
2.3.5
What to do
Update slidedeck2 to 2.3.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection.CVE-2019-15331 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection.
Product
wp-support-plus-responsive-ticket-system
Fixed in
9.1.2
What to do
Update wp-support-plus-responsive-ticket-system to 9.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.CVE-2019-15330 · WordPress plugins & themes · reported by MITREHigh 7.5
The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.
Product
webp-express
Fixed in
0.14.11
What to do
Update webp-express to 0.14.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.CVE-2018-20988 · WordPress plugins & themes · reported by MITREHigh 7.5
The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.
Product
wpgform
Fixed in
0.94
What to do
Update wpgform to 0.94 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.CVE-2017-18586 · WordPress plugins & themes · reported by MITRECritical 9.1
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.
Product
insert-pages
Fixed in
3.2.4
What to do
Update insert-pages to 3.2.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.