Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24,209 results · page 75 of 485
Jul 23, 2026Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions.CVE-2026-65456 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions.
- Affected
- up to 1.13.62
- What to do
- Affects up to 1.13.62. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.CVE-2026-65455 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.
- Affected
- up to 8.14.0
- What to do
- Affects up to 8.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.CVE-2026-65454 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.
- Affected
- up to 11.2.0
- What to do
- Affects up to 11.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.CVE-2026-65453 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
- Affected
- up to 6.19
- What to do
- Affects up to 6.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.CVE-2026-65452 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
- Affected
- up to 6.19
- What to do
- Affects up to 6.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Contributor SQL Injection in MapSVG <= 8.14.0 versions.CVE-2026-65451 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in MapSVG <= 8.14.0 versions.
- Affected
- up to 8.14.0
- What to do
- Affects up to 8.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Contributor SQL Injection in MapSVG <= 8.14.0 versions.CVE-2026-65450 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in MapSVG <= 8.14.0 versions.
- Affected
- up to 8.14.0
- What to do
- Affects up to 8.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.CVE-2026-65449 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.
- Affected
- up to 8.14.0
- What to do
- Affects up to 8.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.CVE-2026-61981 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.
- Affected
- up to 15.0.8
- What to do
- Affects up to 15.0.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.CVE-2026-61973 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
- Affected
- up to 2.8.5
- What to do
- Affects up to 2.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.CVE-2026-61972 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
- Affected
- up to 2.8.5
- What to do
- Affects up to 2.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.CVE-2026-61954 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.
- Affected
- up to 3.8.9
- What to do
- Affects up to 3.8.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.CVE-2026-61951 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.CVE-2026-61950 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated SQL Injection in Bookly <= 27.7 versions.CVE-2026-61949 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Bookly <= 27.7 versions.
- Affected
- up to 27.7
- What to do
- Affects up to 27.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.CVE-2026-61948 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.
- Affected
- up to 6.2.0
- What to do
- Affects up to 6.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.CVE-2026-61947 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.CVE-2026-61946 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.
- Affected
- up to 3.12.27
- What to do
- Affects up to 3.12.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026WooCommerce Product Stock Alert: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-61945 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6.
- Product
- WooCommerce Product Stock Alert
- Affected
- up to 3.0.6
- What to do
- Affects up to 3.0.6. Update WooCommerce Product Stock Alert to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.CVE-2026-61944 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.
- Affected
- up to 27.7
- What to do
- Affects up to 27.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.CVE-2026-61943 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.
- Affected
- up to 6.2.0
- What to do
- Affects up to 6.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.CVE-2026-59555 · WordPress plugins & themes · reported by PatchstackCritical 10
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.
- Affected
- up to 2.7.8.3
- What to do
- Affects up to 2.7.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.CVE-2026-59554 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Authentication in Ziina <= 1.2.21 versions.
- Affected
- up to 1.2.21
- What to do
- Affects up to 1.2.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.CVE-2026-59547 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.
- Affected
- up to 9.1.4
- What to do
- Affects up to 9.1.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.CVE-2026-59545 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.CVE-2026-59544 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.
- Affected
- up to 10.9.3.0
- What to do
- Affects up to 10.9.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.CVE-2026-59543 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions.
- Affected
- up to 3.8.11
- What to do
- Affects up to 3.8.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.CVE-2026-59542 · WordPress plugins & themes · reported by PatchstackHigh 7.7
Subscriber Arbitrary File Deletion in Kali Forms <= 2.4.18 versions.
- Affected
- up to 2.4.18
- What to do
- Affects up to 2.4.18. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.CVE-2026-59541 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Subscriber Privilege Escalation in WP BASE Booking <= 6.3.1 versions.
- Affected
- up to 6.3.1
- What to do
- Affects up to 6.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.CVE-2026-59540 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.
- Affected
- up to 3.9.6
- What to do
- Affects up to 3.9.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.CVE-2026-59526 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.
- Affected
- up to 8.14.0
- What to do
- Affects up to 8.14.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.CVE-2026-59525 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.
- Affected
- up to 2.7.8.3
- What to do
- Affects up to 2.7.8.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.CVE-2026-59524 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.
- Affected
- up to 3.6.7
- What to do
- Affects up to 3.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.CVE-2026-59522 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.
- Affected
- up to 1.17.5
- What to do
- Affects up to 1.17.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.CVE-2026-59517 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.
- Affected
- up to 4.0.12
- What to do
- Affects up to 4.0.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions.CVE-2026-59514 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions.
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.CVE-2026-59513 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.
- Affected
- up to 2.3.0
- What to do
- Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.CVE-2026-59512 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions.
- Affected
- up to 2.2.34.43
- What to do
- Affects up to 2.2.34.43. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.CVE-2026-57809 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.
- Affected
- up to 2.34.0
- What to do
- Affects up to 2.34.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.CVE-2026-57808 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.
- Affected
- up to 4.5.0
- What to do
- Affects up to 4.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.CVE-2026-57785 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.
- Affected
- up to 1.2.63
- What to do
- Affects up to 1.2.63. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.CVE-2026-57784 · WordPress plugins & themes · reported by PatchstackCritical 9.6
Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
- Affected
- up to 3.3.26
- What to do
- Affects up to 3.3.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.CVE-2026-57769 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.
- Affected
- up to 5.7.8
- What to do
- Affects up to 5.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.CVE-2026-57767 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions.
- Affected
- up to 10.1.02
- What to do
- Affects up to 10.1.02. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.CVE-2026-57735 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.CVE-2026-57717 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.
- Affected
- up to 9.6.0.0
- What to do
- Affects up to 9.6.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.CVE-2026-57716 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.
- Affected
- up to 7.2.4
- What to do
- Affects up to 7.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.CVE-2026-57704 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.
- Affected
- up to 8.90.0
- What to do
- Affects up to 8.90.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.CVE-2026-57703 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.
- Affected
- up to 3.6.10.1
- What to do
- Affects up to 3.6.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.CVE-2026-57701 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions.
- Affected
- up to 12.8.5
- What to do
- Affects up to 12.8.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.