Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

5,867 results · page 83 of 118

Aug 22, 2019The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.CVE-2017-18578 · WordPress plugins & themes · reported by MITREMedium 6.1
The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.
Product
crafty-social-buttons
Fixed in
1.5.8
What to do
Update crafty-social-buttons to 1.5.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.CVE-2016-10929 · WordPress plugins & themes · reported by MITREMedium 5.3
The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in.
Product
advanced-ajax-page-loader
Fixed in
2.7.7
What to do
Update advanced-ajax-page-loader to 2.7.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.CVE-2016-10928 · WordPress plugins & themes · reported by MITREHigh 7.5
The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.
Product
onelogin-saml-sso
Fixed in
2.2.0
What to do
Update onelogin-saml-sso to 2.2.0 or newer.
Full record and what to do →NVD record github.com wordpress.org
Aug 22, 2019The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess fCVE-2015-9340 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.
Product
wp-file-upload
Fixed in
3.0.0
What to do
Update wp-file-upload to 3.0.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.CVE-2015-9339 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.
Product
wp-file-upload
Fixed in
2.7.1
What to do
Update wp-file-upload to 2.7.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.CVE-2015-9338 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.
Product
wp-file-upload
Fixed in
2.5.0
What to do
Update wp-file-upload to 2.5.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The email-newsletter plugin through 20.15 for WordPress has SQL injection.CVE-2015-9334 · WordPress plugins & themes · reported by MITRECritical 9.8
The email-newsletter plugin through 20.15 for WordPress has SQL injection.
Product
email-newsletter
Affected
up to 20.15
What to do
Affects up to 20.15. Update email-newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The cforms2 plugin before 10.5 for WordPress has XSS.CVE-2014-10393 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 10.5 for WordPress has XSS.
Product
cforms2
Fixed in
10.5
What to do
Update cforms2 to 10.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.CVE-2014-10386 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-live-chat-support plugin before 4.1.0 for WordPress has JavaScript injections.
Product
wp-live-chat-support
Fixed in
4.1.0
What to do
Update wp-live-chat-support to 4.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.CVE-2014-10382 · WordPress plugins & themes · reported by MITREMedium 4.3
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment.
Product
feature-comments
Fixed in
1.2.5
What to do
Update feature-comments to 1.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion.CVE-2013-7483 · WordPress plugins & themes · reported by MITRECritical 9.8
The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion.
Product
slidedeck2
Fixed in
2.3.5
What to do
Update slidedeck2 to 2.3.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection.CVE-2019-15331 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection.
Product
wp-support-plus-responsive-ticket-system
Fixed in
9.1.2
What to do
Update wp-support-plus-responsive-ticket-system to 9.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.CVE-2019-15330 · WordPress plugins & themes · reported by MITREHigh 7.5
The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.
Product
webp-express
Fixed in
0.14.11
What to do
Update webp-express to 0.14.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.CVE-2018-20988 · WordPress plugins & themes · reported by MITREHigh 7.5
The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.
Product
wpgform
Fixed in
0.94
What to do
Update wpgform to 0.94 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.CVE-2017-18586 · WordPress plugins & themes · reported by MITRECritical 9.1
The insert-pages plugin before 3.2.4 for WordPress has directory traversal via custom template paths.
Product
insert-pages
Fixed in
3.2.4
What to do
Update insert-pages to 3.2.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.CVE-2016-10930 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number.
Product
wp-support-plus-responsive-ticket-system
Fixed in
7.1.0
What to do
Update wp-support-plus-responsive-ticket-system to 7.1.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.CVE-2015-9341 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.
Product
wp-file-upload
Fixed in
3.4.1
What to do
Update wp-file-upload to 3.4.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header.CVE-2014-10394 · WordPress plugins & themes · reported by MITREMedium 6.1
The rich-counter plugin before 1.2.0 for WordPress has JavaScript injection via a User-Agent header.
Product
rich-counter
Fixed in
1.2.0
What to do
Update rich-counter to 1.2.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The cforms2 plugin before 10.2 for WordPress has XSS.CVE-2014-10392 · WordPress plugins & themes · reported by MITREMedium 6.1
The cforms2 plugin before 10.2 for WordPress has XSS.
Product
cforms2
Fixed in
10.2
What to do
Update cforms2 to 10.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.CVE-2014-10391 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-support-plus-responsive-ticket-system plugin before 4.1 for WordPress has JavaScript injection.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.1
What to do
Update wp-support-plus-responsive-ticket-system to 4.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.CVE-2014-10390 · WordPress plugins & themes · reported by MITRECritical 9.1
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.2
What to do
Update wp-support-plus-responsive-ticket-system to 4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.CVE-2014-10389 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.2
What to do
Update wp-support-plus-responsive-ticket-system to 4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure.CVE-2014-10388 · WordPress plugins & themes · reported by MITREMedium 5.3
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has full path disclosure.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.2
What to do
Update wp-support-plus-responsive-ticket-system to 4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection.CVE-2014-10387 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection.
Product
wp-support-plus-responsive-ticket-system
Fixed in
4.2
What to do
Update wp-support-plus-responsive-ticket-system to 4.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.CVE-2019-15324 · WordPress plugins & themes · reported by MITREHigh 8.8
The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.
Product
ad-inserter
Fixed in
2.4.22
What to do
Update ad-inserter to 2.4.22 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The ad-inserter plugin before 2.4.20 for WordPress has path traversal.CVE-2019-15323 · WordPress plugins & themes · reported by MITREHigh 7.5
The ad-inserter plugin before 2.4.20 for WordPress has path traversal.
Product
ad-inserter
Fixed in
2.4.20
What to do
Update ad-inserter to 2.4.20 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.CVE-2019-15322 · WordPress plugins & themes · reported by MITRECritical 9.8
The shortcode-factory plugin before 2.8 for WordPress has Local File Inclusion.
Product
shortcode-factory
Fixed in
2.8
What to do
Update shortcode-factory to 2.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.CVE-2019-15321 · WordPress plugins & themes · reported by MITRECritical 9.8
The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled.
Product
option-tree
Fixed in
2.7.3
What to do
Update option-tree to 2.7.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.CVE-2019-15320 · WordPress plugins & themes · reported by MITRECritical 9.8
The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled.
Product
option-tree
Fixed in
2.7.3
What to do
Update option-tree to 2.7.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.CVE-2019-15319 · WordPress plugins & themes · reported by MITRECritical 9.8
The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce.
Product
option-tree
Fixed in
2.7.0
What to do
Update option-tree to 2.7.0 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 22, 2019The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec.CVE-2018-20985 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-payeezy-pay plugin before 2.98 for WordPress has local file inclusion in pay.php, donate.php, donate-rec, and pay-rec.
Product
wp-payeezy-pay
Fixed in
2.98
What to do
Update wp-payeezy-pay to 2.98 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.CVE-2018-20984 · WordPress plugins & themes · reported by MITRECritical 9.8
The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.
Product
patreon-connect
Fixed in
1.2.2
What to do
Update patreon-connect to 1.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.CVE-2018-20983 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.
Product
wp-retina-2x
Fixed in
5.2.3
What to do
Update wp-retina-2x to 5.2.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.CVE-2017-18584 · WordPress plugins & themes · reported by MITREHigh 7.5
The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.
Product
post-pay-counter
Fixed in
2.731
What to do
Update post-pay-counter to 2.731 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.CVE-2017-18583 · WordPress plugins & themes · reported by MITRECritical 9.8
The post-pay-counter plugin before 2.731 for WordPress has PHP Object Injection.
Product
post-pay-counter
Fixed in
2.731
What to do
Update post-pay-counter to 2.731 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.CVE-2017-18582 · WordPress plugins & themes · reported by MITREMedium 6.1
The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.
Product
time-sheets
Fixed in
1.5.2
What to do
Update time-sheets to 1.5.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.CVE-2017-18581 · WordPress plugins & themes · reported by MITREMedium 6.1
The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.
Product
time-sheets
Fixed in
1.5.0
What to do
Update time-sheets to 1.5.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.CVE-2017-18580 · WordPress plugins & themes · reported by MITRECritical 9.8
The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta, post, or user shortcode.
Product
shortcodes-ultimate
Fixed in
5.0.1
What to do
Update shortcodes-ultimate to 5.0.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.CVE-2017-18577 · WordPress plugins & themes · reported by MITREMedium 6.1
The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.
Product
mailchimp-for-wp
Fixed in
4.1.8
What to do
Update mailchimp-for-wp to 4.1.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.CVE-2017-18576 · WordPress plugins & themes · reported by MITREMedium 6.1
The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.
Product
event-notifier
Fixed in
1.2.1
What to do
Update event-notifier to 1.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.CVE-2016-10927 · WordPress plugins & themes · reported by MITRECritical 10
The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.
Product
nelio-ab-testing
Fixed in
4.5.11
What to do
Update nelio-ab-testing to 4.5.11 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.CVE-2016-10926 · WordPress plugins & themes · reported by MITRECritical 10
The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.
Product
nelio-ab-testing
Fixed in
4.5.9
What to do
Update nelio-ab-testing to 4.5.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.CVE-2016-10925 · WordPress plugins & themes · reported by MITREMedium 6.1
The peters-login-redirect plugin before 2.9.1 for WordPress has XSS during the editing of redirect URLs.
Product
peters-login-redirect
Fixed in
2.9.1
What to do
Update peters-login-redirect to 2.9.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ebook-download plugin before 1.2 for WordPress has directory traversal.CVE-2016-10924 · WordPress plugins & themes · reported by MITREHigh 7.5
The ebook-download plugin before 1.2 for WordPress has directory traversal.
Product
ebook-download
Fixed in
1.2
What to do
Update ebook-download to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.CVE-2016-10923 · WordPress plugins & themes · reported by MITRECritical 9.8
The woocommerce-store-toolkit plugin before 1.5.8 for WordPress has privilege escalation.
Product
woocommerce-store-toolkit
Fixed in
1.5.8
What to do
Update woocommerce-store-toolkit to 1.5.8 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.CVE-2016-10922 · WordPress plugins & themes · reported by MITRECritical 9.8
The woocommerce-store-toolkit plugin before 1.5.7 for WordPress has privilege escalation.
Product
woocommerce-store-toolkit
Fixed in
1.5.7
What to do
Update woocommerce-store-toolkit to 1.5.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.CVE-2015-9337 · WordPress plugins & themes · reported by MITREHigh 7.5
The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
Product
profile-builder
Fixed in
2.1.4
What to do
Update profile-builder to 2.1.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.CVE-2014-10385 · WordPress plugins & themes · reported by MITREMedium 6.1
The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.
Product
memphis-documents-library
Fixed in
3.0
What to do
Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.CVE-2014-10384 · WordPress plugins & themes · reported by MITRECritical 9.8
The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion.
Product
memphis-documents-library
Fixed in
3.0
What to do
Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.CVE-2014-10383 · WordPress plugins & themes · reported by MITRECritical 9.8
The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion.
Product
memphis-documents-library
Fixed in
3.0
What to do
Update memphis-documents-library to 3.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.