Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14,013 results · page 77 of 281
Aug 20, 202610Web Form Maker by 10Web form-maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-66616 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.49.
- Product
- 10Web Form Maker by 10Web form-maker
- Affected
- up to 1.15.49
- What to do
- Affects up to 1.15.49. Update 10Web Form Maker by 10Web form-maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.CVE-2026-66615 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.CVE-2026-66614 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.CVE-2026-66612 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Aora <= 1.3.19 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.CVE-2026-66611 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce <= 4.1.10 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.CVE-2026-66609 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.CVE-2026-66607 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.CVE-2026-66606 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.CVE-2026-66605 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.CVE-2026-66604 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.CVE-2026-66601 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.CVE-2026-66600 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.CVE-2026-66598 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.CVE-2026-66597 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.CVE-2026-66595 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.CVE-2026-66594 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.CVE-2026-66593 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.CVE-2026-66592 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.CVE-2026-66590 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.CVE-2026-66586 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.CVE-2026-66583 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.CVE-2026-66582 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.CVE-2026-66581 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.CVE-2026-28150 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.CVE-2025-53999 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.CVE-2025-15689 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated SQL Injection in Capella <= 2.5.5 versions.CVE-2025-15688 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Capella <= 2.5.5 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.CVE-2025-15637 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.
- What to do
- Update the plugin to the newest version.
Aug 20, 2026Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did not enforce access coCVE-2026-77026 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension < 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tCVE-2026-76610 · Websites & servers · reported by security@joomla.orgMedium 6.9
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4CVE-2026-76569 · Websites & servers · reported by security@joomla.orgMedium 5.3
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7CVE-2026-76565 · Websites & servers · reported by security@joomla.orgMedium 5.3
Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7CVE-2026-76564 · Websites & servers · reported by security@joomla.orgHigh 8.6
Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fielCVE-2026-75948 · Websites & servers · reported by security@joomla.orgHigh 8.6
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fields as raw strings with no output-side HTML-attribute escaping.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026Events Made Easy: Local File InclusionCVE-2026-75963 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction.
- Product
- Events Made Easy
- Affected
- up to 3.2.5
- What to do
- Affects up to 3.2.5. Update Events Made Easy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 20, 2026JSON Options: Does not have any capability check or nonce verification on one of its actionsCVE-2026-75860 · WordPress plugins & themes · reported by WPScanCritical 9.8
The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.
- Product
- JSON Options
- Affected
- up to 0.0.4
- What to do
- Affects up to 0.0.4. Update JSON Options to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 20, 2026Kirki: Does not properly validate the files contained in archives uploaded by users with the Editor roleCVE-2026-74992 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations.
- Product
- Kirki
- Fixed in
- 6.2.3
- What to do
- Update Kirki to 6.2.3 or newer.
Aug 20, 2026GutenKit: Does not have a sufficient capability check on some of its REST API endpointsCVE-2026-19699 · WordPress plugins & themes · reported by WPScanLow 2.7
The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.
- Product
- GutenKit
- Fixed in
- 2.5.0
- What to do
- Update GutenKit to 2.5.0 or newer.
Aug 20, 2026GutenKit: Does not sanitise uploaded SVG files on all of the upload paths it enablesCVE-2026-19697 · WordPress plugins & themes · reported by WPScanMedium 6.8
The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators.
- Product
- GutenKit
- Fixed in
- 2.5.0
- What to do
- Update GutenKit to 2.5.0 or newer.
Aug 20, 2026Admin and Site Enhancements (ASE): Does not sanitise uploaded SVG files on every route it accepts them throughCVE-2026-19615 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who opens it.
- Product
- Admin and Site Enhancements (ASE)
- Fixed in
- 9.0.1
- What to do
- Update Admin and Site Enhancements (ASE) to 9.0.1 or newer.
Aug 20, 2026AI Agent by SiteGround: Authorization bypassCVE-2026-17153 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images to the WordPress media library, bypassing the upload_files capability restriction that Contributors are normally subject to, as authenticated attackers with Contributor-level access or above can satisfy the endpoint's nonce and permission checks. The sg_ai_studio_gutenberg_nonce required by the endpoint is emitted to any user with block editor access — including Contributors — making the absent upload_files check the sole barrier to exploitation.
- Product
- AI Agent by SiteGround
- Affected
- up to 1.2.7
- What to do
- Affects up to 1.2.7. Update AI Agent by SiteGround to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 20, 2026Depicter — Popup & Slider Builder: Does not validate the type of a file uploaded through its import feature and does not remove a malformed uploadCVE-2026-15049 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded through its import feature and does not remove a malformed upload, allowing users with editor-level access to write an arbitrary file (including executable PHP) into a web-accessible directory, which can lead to remote code execution.
- Product
- Depicter — Popup & Slider Builder
- Fixed in
- 4.8.0
- What to do
- Update Depicter — Popup & Slider Builder to 4.8.0 or newer.
Aug 20, 2026Royal Addons for Elementor: Does not correctly sanitise custom widget markup before writing it to a file that is later executedCVE-2026-13405 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.
- Product
- Royal Addons for Elementor
- Fixed in
- 1.7.1066
- What to do
- Update Royal Addons for Elementor to 1.7.1066 or newer.
Aug 19, 2026TrueBooker – Appointment Booking and Scheduler System: Authorization Bypass Through User-Controlled Key leading to Account TakeoverCVE-2026-18315 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to wp_update_user. This makes it possible for unauthenticated attackers to overwrite the email address of any WordPress user — including an administrator — and then complete the standard WordPress lost-password flow to fully take over the targeted account.
- Product
- TrueBooker – Appointment Booking and Scheduler System
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update TrueBooker – Appointment Booking and Scheduler System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
NVD recordplugins.svn.wordpress.orgplugins.svn.wordpress.org
Aug 19, 2026Elementor Pro: Unrestricted Upload of File with Dangerous TypeCVE-2026-32475 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1.
- Product
- Elementor Pro
- Affected
- up to 4.2.1
- What to do
- Affects up to 4.2.1. Update Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 19, 2026Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode.CVE-2026-64851 · WordPress plugins & themes · reported by GitHubHigh 8.5
Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.
- Fixed in
- 6.2.2
- What to do
- Update the plugin to 6.2.2 or newer.
Aug 19, 2026Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3 - Pagination values were not strictly typed.CVE-2026-75956 · Websites & servers · reported by security@joomla.orgHigh 8.7
Joomla Extension - cmsjunkie.com - DOS vector in pagination parameter handling in J-BusinessDirectory < 6.2.3 - Pagination values were not strictly typed. Array/non-numeric values (for example limitstart[]) could trigger PHP type errors in arithmetic, and limit was not validated before use in list queries.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3 - companyName from the request was written unescaped into an XMLCVE-2026-75955 · Websites & servers · reported by security@joomla.orgMedium 5.1
Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3 - companyName from the request was written unescaped into an XML attribute.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concatenated into SQL.CVE-2026-75954 · Websites & servers · reported by security@joomla.orgCritical 9.3
Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2026Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_idCVE-2026-75953 · Websites & servers · reported by security@joomla.orgHigh 7.5
Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_id_event) instead of the server-side offer/event record, so mail could be sent to an arbitrary address.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. The WordPress, CMS and hosting-panel entries come from the National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan and others); we show who. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, a booking system, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.