Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

5,867 results · page 82 of 118

Aug 28, 2019The gigpress plugin before 2.3.11 for WordPress has XSS.CVE-2015-9354 · WordPress plugins & themes · reported by MITREMedium 4.8
The gigpress plugin before 2.3.11 for WordPress has XSS.
Product
gigpress
Fixed in
2.3.11
What to do
Update gigpress to 2.3.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.CVE-2015-9353 · WordPress plugins & themes · reported by MITREHigh 7.2
The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-2015-4066.
Product
gigpress
Fixed in
2.3.11
What to do
Update gigpress to 2.3.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The sharebar plugin before 1.2.2 for WordPress has SQL injection.CVE-2012-6719 · WordPress plugins & themes · reported by MITRECritical 9.8
The sharebar plugin before 1.2.2 for WordPress has SQL injection.
Product
sharebar
Fixed in
1.2.2
What to do
Update sharebar to 1.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.CVE-2012-6718 · WordPress plugins & themes · reported by MITREMedium 6.1
The sharebar plugin before 1.2.2 for WordPress has XSS, a different issue than CVE-2013-3491.
Product
sharebar
Fixed in
1.2.2
What to do
Update sharebar to 1.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.CVE-2012-6717 · WordPress plugins & themes · reported by MITREMedium 6.1
The redirection plugin before 2.2.12 for WordPress has XSS, a different issue than CVE-2011-4562.
Product
redirection
Fixed in
2.2.12
What to do
Update redirection to 2.2.12 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 28, 2019The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.CVE-2011-5329 · WordPress plugins & themes · reported by MITREMedium 6.1
The redirection plugin before 2.2.9 for WordPress has XSS in the admin menu, a different issue than CVE-2011-4562.
Product
redirection
Fixed in
2.2.9
What to do
Update redirection to 2.2.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress.CVE-2019-14314 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via modules/nextgen_gallery_display/package.module.nextgen_gallery_display.php.
Product
A SQL injection vulnerability exists in the Imagely NextGEN Gallery
Fixed in
3.2.11
What to do
Update A SQL injection vulnerability exists in the Imagely NextGEN Gallery to 3.2.11 or newer.
Full record and what to do →NVD record de.wordpress.org wordpress.org
Aug 27, 2019The wp-members plugin before 3.2.8 for WordPress has CSRF.CVE-2019-15660 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-members plugin before 3.2.8 for WordPress has CSRF.
Product
wp-members
Fixed in
3.2.8
What to do
Update wp-members to 3.2.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme upCVE-2019-15650 · WordPress plugins & themes · reported by MITREMedium 4.3
The stops-core-theme-and-plugin-updates plugin before 8.0.5 for WordPress has insufficient restrictions on option changes (such as disabling unattended theme updates) because of a nonce check error.
Product
stops-core-theme-and-plugin-updates
Fixed in
8.0.5
What to do
Update stops-core-theme-and-plugin-updates to 8.0.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.CVE-2017-18592 · WordPress plugins & themes · reported by MITREHigh 7.5
The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.
Product
woocommerce-catalog-enquiry
Fixed in
3.1.0
What to do
Update woocommerce-catalog-enquiry to 3.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.CVE-2017-18591 · WordPress plugins & themes · reported by MITREMedium 6.1
The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.
Product
gd-rating-system
Fixed in
2.1
What to do
Update gd-rating-system to 2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.CVE-2016-10936 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-polls plugin before 2.73.1 for WordPress has XSS via the Poll bar option.
Product
wp-polls
Fixed in
2.73.1
What to do
Update wp-polls to 2.73.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The wp-polls plugin before 2.72 for WordPress has SQL injection.CVE-2015-9352 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-polls plugin before 2.72 for WordPress has SQL injection.
Product
wp-polls
Fixed in
2.72
What to do
Update wp-polls to 2.72 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.CVE-2015-9351 · WordPress plugins & themes · reported by MITRECritical 9.8
The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.
Product
feed-them-social
Fixed in
1.7.0
What to do
Update feed-them-social to 1.7.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.CVE-2015-9350 · WordPress plugins & themes · reported by MITREMedium 6.1
The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.
Product
feed-them-social
Fixed in
1.7.0
What to do
Update feed-them-social to 1.7.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.CVE-2015-9348 · WordPress plugins & themes · reported by MITREHigh 7.5
The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.
Product
sell-downloads
Fixed in
1.0.8
What to do
Update sell-downloads to 1.0.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.CVE-2019-15659 · WordPress plugins & themes · reported by MITRECritical 9.8
The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.
Product
pie-register
Fixed in
3.1.2
What to do
Update pie-register to 3.1.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.CVE-2019-15649 · WordPress plugins & themes · reported by MITREHigh 8.8
The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload.
Product
insert-or-embed-articulate-content-into-wordpress
Fixed in
4.2999
What to do
Update insert-or-embed-articulate-content-into-wordpress to 4.2999 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.CVE-2019-15648 · WordPress plugins & themes · reported by MITREMedium 6.5
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber.
Product
insert-or-embed-articulate-content-into-wordpress
Fixed in
4.29991
What to do
Update insert-or-embed-articulate-content-into-wordpress to 4.29991 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.CVE-2019-15647 · WordPress plugins & themes · reported by MITREHigh 8.8
The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution.
Product
groundhogg
Fixed in
1.3.5
What to do
Update groundhogg to 1.3.5 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The rsvpmaker plugin before 6.2 for WordPress has SQL injection.CVE-2019-15646 · WordPress plugins & themes · reported by MITRECritical 9.8
The rsvpmaker plugin before 6.2 for WordPress has SQL injection.
Product
rsvpmaker
Fixed in
6.2
What to do
Update rsvpmaker to 6.2 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 27, 2019The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.CVE-2019-15645 · WordPress plugins & themes · reported by MITREHigh 8.8
The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.
Product
zoho-salesiq
Fixed in
1.0.9
What to do
Update zoho-salesiq to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.CVE-2019-15644 · WordPress plugins & themes · reported by MITREMedium 6.1
The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.
Product
zoho-salesiq
Fixed in
1.0.9
What to do
Update zoho-salesiq to 1.0.9 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.CVE-2019-15643 · WordPress plugins & themes · reported by MITREMedium 6.1
The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.
Product
ultimate-faqs
Fixed in
1.8.22
What to do
Update ultimate-faqs to 1.8.22 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.CVE-2018-21006 · WordPress plugins & themes · reported by MITREHigh 8.8
The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.
Product
bbp-move-topics
Fixed in
1.1.6
What to do
Update bbp-move-topics to 1.1.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The bbp-move-topics plugin before 1.1.6 for WordPress has code injection.CVE-2018-21005 · WordPress plugins & themes · reported by MITRECritical 9.8
The bbp-move-topics plugin before 1.1.6 for WordPress has code injection.
Product
bbp-move-topics
Fixed in
1.1.6
What to do
Update bbp-move-topics to 1.1.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection.CVE-2018-21004 · WordPress plugins & themes · reported by MITRECritical 9.8
The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection.
Product
rsvpmaker
Fixed in
5.6.4
What to do
Update rsvpmaker to 5.6.4 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 27, 2019The buddyforms plugin before 2.2.8 for WordPress has SQL injection.CVE-2018-21003 · WordPress plugins & themes · reported by MITRECritical 9.8
The buddyforms plugin before 2.2.8 for WordPress has SQL injection.
Product
buddyforms
Fixed in
2.2.8
What to do
Update buddyforms to 2.2.8 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.CVE-2018-21002 · WordPress plugins & themes · reported by MITREHigh 8.8
The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.
Product
js-support-ticket
Fixed in
2.0.6
What to do
Update js-support-ticket to 2.0.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The anycomment plugin before 0.0.33 for WordPress has XSS.CVE-2018-21001 · WordPress plugins & themes · reported by MITREMedium 6.1
The anycomment plugin before 0.0.33 for WordPress has XSS.
Product
anycomment
Fixed in
0.0.33
What to do
Update anycomment to 0.0.33 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.CVE-2017-18590 · WordPress plugins & themes · reported by MITREMedium 6.1
The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.
Product
timesheet
Fixed in
0.1.5
What to do
Update timesheet to 0.1.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.CVE-2016-10935 · WordPress plugins & themes · reported by MITRECritical 9.8
The woocommerce-exporter plugin before 1.8.4 for WordPress has privilege escalation.
Product
woocommerce-exporter
Fixed in
1.8.4
What to do
Update woocommerce-exporter to 1.8.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 27, 2019The check-email plugin before 0.5.2 for WordPress has XSS.CVE-2016-10934 · WordPress plugins & themes · reported by MITREMedium 6.1
The check-email plugin before 0.5.2 for WordPress has XSS.
Product
check-email
Fixed in
0.5.2
What to do
Update check-email to 0.5.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.CVE-2015-9349 · WordPress plugins & themes · reported by MITREMedium 6.1
The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the "built-in (old)" file browser.
Product
ckeditor-for-wordpress
Fixed in
4.5.3.1
What to do
Update ckeditor-for-wordpress to 4.5.3.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.CVE-2015-9347 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.
Product
wp-plotly
Fixed in
1.0.3
What to do
Update wp-plotly to 1.0.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The cp-polls plugin before 1.0.5 for WordPress has XSS.CVE-2015-9346 · WordPress plugins & themes · reported by MITREMedium 6.1
The cp-polls plugin before 1.0.5 for WordPress has XSS.
Product
cp-polls
Fixed in
1.0.5
What to do
Update cp-polls to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.CVE-2015-9345 · WordPress plugins & themes · reported by MITREHigh 7.5
The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.
Product
link-log
Fixed in
2.0
What to do
Update link-log to 2.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The link-log plugin before 2.1 for WordPress has SQL injection.CVE-2015-9344 · WordPress plugins & themes · reported by MITRECritical 9.8
The link-log plugin before 2.1 for WordPress has SQL injection.
Product
link-log
Fixed in
2.1
What to do
Update link-log to 2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The wp-rollback plugin before 1.2.3 for WordPress has CSRF.CVE-2015-9343 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-rollback plugin before 1.2.3 for WordPress has CSRF.
Product
wp-rollback
Fixed in
1.2.3
What to do
Update wp-rollback to 1.2.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The wp-rollback plugin before 1.2.3 for WordPress has XSS.CVE-2015-9342 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-rollback plugin before 1.2.3 for WordPress has XSS.
Product
wp-rollback
Fixed in
1.2.3
What to do
Update wp-rollback to 1.2.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 27, 2019The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.CVE-2014-10395 · WordPress plugins & themes · reported by MITREMedium 6.1
The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.
Product
cp-polls
Fixed in
1.0.1
What to do
Update cp-polls to 1.0.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 23, 2019The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name,CVE-2019-15092 · WordPress plugins & themes · reported by MITREHigh 7.3
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.
Affected
up to 1.3.1
What to do
Affects up to 1.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com hackpuntes.com
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.CVE-2019-15329 · WordPress plugins & themes · reported by MITREHigh 8.8
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.
Product
import-users-from-csv-with-meta
Fixed in
1.14.0.3
What to do
Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.CVE-2019-15328 · WordPress plugins & themes · reported by MITREMedium 6.1
The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.
Product
import-users-from-csv-with-meta
Fixed in
1.14.0.3
What to do
Update import-users-from-csv-with-meta to 1.14.0.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.CVE-2019-15327 · WordPress plugins & themes · reported by MITREMedium 6.1
The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.
Product
import-users-from-csv-with-meta
Fixed in
1.14.1.3
What to do
Update import-users-from-csv-with-meta to 1.14.1.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.CVE-2019-15326 · WordPress plugins & themes · reported by MITREHigh 7.5
The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.
Product
import-users-from-csv-with-meta
Fixed in
1.14.2.1
What to do
Update import-users-from-csv-with-meta to 1.14.2.1 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.CVE-2018-20987 · WordPress plugins & themes · reported by MITRECritical 9.8
The newsletters-lite plugin before 4.6.8.6 for WordPress has PHP object injection.
Product
newsletters-lite
Fixed in
4.6.8.6
What to do
Update newsletters-lite to 4.6.8.6 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.CVE-2018-20986 · WordPress plugins & themes · reported by MITREMedium 5.4
The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.
Product
advanced-custom-fields (aka Elliot Condon Advanced Custom Fields)
Fixed in
5.7.8
What to do
Update advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) to 5.7.8 or newer.
Full record and what to do →NVD record wordpress.org advancedcustomfields.com
Aug 22, 2019The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.CVE-2017-18585 · WordPress plugins & themes · reported by MITREHigh 8.1
The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.
Product
posts-in-page
Fixed in
1.3.0
What to do
Update posts-in-page to 1.3.0 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 22, 2019The corner-ad plugin before 1.0.8 for WordPress has XSS.CVE-2017-18579 · WordPress plugins & themes · reported by MITREMedium 6.1
The corner-ad plugin before 1.0.8 for WordPress has XSS.
Product
corner-ad
Fixed in
1.0.8
What to do
Update corner-ad to 1.0.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.