Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

5,867 results · page 86 of 118

Aug 20, 2019The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.CVE-2015-9320 · WordPress plugins & themes · reported by MITREMedium 6.1
The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.
Product
option-tree
Fixed in
2.5.4
What to do
Update option-tree to 2.5.4 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 20, 2019The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.CVE-2015-9319 · WordPress plugins & themes · reported by MITREMedium 6.1
The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.
Product
gregs-high-performance-seo
Fixed in
1.6.2
What to do
Update gregs-high-performance-seo to 1.6.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.CVE-2019-15238 · WordPress plugins & themes · reported by MITREHigh 8.8
The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field.
Product
cforms2
Fixed in
15.0.2
What to do
Update cforms2 to 15.0.2 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 20, 2019The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.CVE-2017-18569 · WordPress plugins & themes · reported by MITREHigh 8.8
The my-wp-translate plugin before 1.0.4 for WordPress has CSRF.
Product
my-wp-translate
Fixed in
1.0.4
What to do
Update my-wp-translate to 1.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The my-wp-translate plugin before 1.0.4 for WordPress has XSS.CVE-2017-18568 · WordPress plugins & themes · reported by MITREMedium 6.1
The my-wp-translate plugin before 1.0.4 for WordPress has XSS.
Product
my-wp-translate
Fixed in
1.0.4
What to do
Update my-wp-translate to 1.0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.4.6 for WordPress has XSS.CVE-2017-18567 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.4.6 for WordPress has XSS.
Product
wp-all-import
Fixed in
3.4.6
What to do
Update wp-all-import to 3.4.6 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.CVE-2017-18520 · WordPress plugins & themes · reported by MITREMedium 6.1
The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.
Product
democracy-poll
Fixed in
5.4
What to do
Update democracy-poll to 5.4 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 20, 2019The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.CVE-2017-18517 · WordPress plugins & themes · reported by MITREMedium 6.1
The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.
Product
bws-pinterest
Fixed in
1.0.5
What to do
Update bws-pinterest to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.CVE-2016-10915 · WordPress plugins & themes · reported by MITREHigh 8.8
The popup-by-supsystic plugin before 1.7.9 for WordPress has CSRF.
Product
popup-by-supsystic
Fixed in
1.7.9
What to do
Update popup-by-supsystic to 1.7.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.CVE-2016-10914 · WordPress plugins & themes · reported by MITREHigh 8.8
The add-from-server plugin before 3.3.2 for WordPress has CSRF for importing a large file.
Product
add-from-server
Fixed in
3.3.2
What to do
Update add-from-server to 3.3.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.CVE-2016-10913 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-latest-posts plugin before 3.7.5 for WordPress has XSS.
Product
wp-latest-posts
Fixed in
3.7.5
What to do
Update wp-latest-posts to 3.7.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.CVE-2016-10893 · WordPress plugins & themes · reported by MITREMedium 6.1
The crayon-syntax-highlighter plugin before 2.8.4 for WordPress has multiple XSS issues via AJAX requests.
Product
crayon-syntax-highlighter
Fixed in
2.8.4
What to do
Update crayon-syntax-highlighter to 2.8.4 or newer.
Full record and what to do →NVD record github.com github.com
Aug 20, 2019The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.CVE-2015-9332 · WordPress plugins & themes · reported by MITREMedium 6.5
The uninstall plugin before 1.2 for WordPress has CSRF to delete all tables via the wp-admin/admin-ajax.php?action=uninstall URI.
Product
uninstall
Fixed in
1.2
What to do
Update uninstall to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.CVE-2015-9331 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Product
wp-all-import
Fixed in
3.2.4
What to do
Update wp-all-import to 3.2.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.CVE-2015-9330 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Product
wp-all-import
Fixed in
3.2.5
What to do
Update wp-all-import to 3.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.CVE-2015-9329 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.
Product
wp-all-import
Fixed in
3.2.5
What to do
Update wp-all-import to 3.2.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.CVE-2015-9318 · WordPress plugins & themes · reported by MITREHigh 7.5
The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.
Product
awesome-support
Fixed in
3.1.7
What to do
Update awesome-support to 3.1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.CVE-2015-9317 · WordPress plugins & themes · reported by MITREMedium 6.1
The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.
Product
awesome-support
Fixed in
3.1.7
What to do
Update awesome-support to 3.1.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.CVE-2014-10381 · WordPress plugins & themes · reported by MITREHigh 8.8
The user-domain-whitelist plugin before 1.5 for WordPress has CSRF.
Product
user-domain-whitelist
Fixed in
1.5
What to do
Update user-domain-whitelist to 1.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The user-access-manager plugin before 1.2 for WordPress has CSRF.CVE-2011-5328 · WordPress plugins & themes · reported by MITREHigh 8.8
The user-access-manager plugin before 1.2 for WordPress has CSRF.
Product
user-access-manager
Fixed in
1.2
What to do
Update user-access-manager to 1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 20, 2019The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.CVE-2019-15082 · WordPress plugins & themes · reported by MITREMedium 6.1
The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.
Product
360-product-rotation
Fixed in
1.4.8
What to do
Update 360-product-rotation to 1.4.8 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 16, 2019The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.CVE-2019-15116 · WordPress plugins & themes · reported by MITREMedium 6.1
The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.
Product
easy-digital-downloads
Fixed in
2.9.16
What to do
Update easy-digital-downloads to 2.9.16 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 16, 2019The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.CVE-2019-15115 · WordPress plugins & themes · reported by MITREHigh 8.8
The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.
Product
peters-login-redirect
Fixed in
2.9.2
What to do
Update peters-login-redirect to 2.9.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.CVE-2019-15114 · WordPress plugins & themes · reported by MITREHigh 8.8
The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.
Product
formcraft-form-builder
Fixed in
1.2.2
What to do
Update formcraft-form-builder to 1.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.CVE-2019-15113 · WordPress plugins & themes · reported by MITREHigh 8.8
The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.
Product
companion-sitemap-generator
Fixed in
3.7.0
What to do
Update companion-sitemap-generator to 3.7.0 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The js-jobs plugin before 1.0.7 for WordPress has CSRF.CVE-2018-20974 · WordPress plugins & themes · reported by MITREHigh 8.8
The js-jobs plugin before 1.0.7 for WordPress has CSRF.
Product
js-jobs
Fixed in
1.0.7
What to do
Update js-jobs to 1.0.7 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion.CVE-2018-20973 · WordPress plugins & themes · reported by MITRECritical 9.8
The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion.
Product
companion-auto-update
Fixed in
3.2.1
What to do
Update companion-auto-update to 3.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.CVE-2018-20972 · WordPress plugins & themes · reported by MITREHigh 8.8
The companion-auto-update plugin before 3.2.1 for WordPress has CSRF.
Product
companion-auto-update
Fixed in
3.2.1
What to do
Update companion-auto-update to 3.2.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.CVE-2018-20971 · WordPress plugins & themes · reported by MITREHigh 8.8
The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.
Product
church-admin
Fixed in
1.2550
What to do
Update church-admin to 1.2550 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.CVE-2017-18547 · WordPress plugins & themes · reported by MITREHigh 8.8
The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.
Product
nelio-ab-testing
Fixed in
4.6.4
What to do
Update nelio-ab-testing to 4.6.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.CVE-2017-18546 · WordPress plugins & themes · reported by MITREHigh 8.8
The jayj-quicktag plugin before 1.3.2 for WordPress has CSRF.
Product
jayj-quicktag
Fixed in
1.3.2
What to do
Update jayj-quicktag to 1.3.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.CVE-2017-18545 · WordPress plugins & themes · reported by MITREHigh 7.5
The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input.
Product
invite-anyone
Fixed in
1.3.16
What to do
Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.CVE-2017-18544 · WordPress plugins & themes · reported by MITREHigh 8.8
The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF.
Product
invite-anyone
Fixed in
1.3.16
What to do
Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.CVE-2017-18543 · WordPress plugins & themes · reported by MITRECritical 9.8
The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations.
Product
invite-anyone
Fixed in
1.3.16
What to do
Update invite-anyone to 1.3.16 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.CVE-2017-18542 · WordPress plugins & themes · reported by MITREMedium 6.1
The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.
Product
zendesk-help-center
Fixed in
1.0.5
What to do
Update zendesk-help-center to 1.0.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The xo-security plugin before 1.5.3 for WordPress has XSS.CVE-2017-18541 · WordPress plugins & themes · reported by MITREMedium 6.1
The xo-security plugin before 1.5.3 for WordPress has XSS.
Product
xo-security
Fixed in
1.5.3
What to do
Update xo-security to 1.5.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.CVE-2015-9324 · WordPress plugins & themes · reported by MITRECritical 9.8
The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.
Product
easy-digital-downloads
Fixed in
2.3.3
What to do
Update easy-digital-downloads to 2.3.3 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 16, 2019The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.CVE-2015-9323 · WordPress plugins & themes · reported by MITRECritical 9.8
The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
Product
404-to-301
Fixed in
2.0.3
What to do
Update 404-to-301 to 2.0.3 or newer.
Full record and what to do →NVD record github.com wordpress.org
Aug 16, 2019The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.CVE-2015-9322 · WordPress plugins & themes · reported by MITREHigh 8.8
The erident-custom-login-and-dashboard plugin before 3.5 for WordPress has CSRF.
Product
erident-custom-login-and-dashboard
Fixed in
3.5
What to do
Update erident-custom-login-and-dashboard to 3.5 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.CVE-2014-10376 · WordPress plugins & themes · reported by MITRECritical 9.8
The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.
Product
i-recommend-this
Fixed in
3.7.3
What to do
Update i-recommend-this to 3.7.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The note-press plugin before 0.1.2 for WordPress has SQL injection.CVE-2017-18548 · WordPress plugins & themes · reported by MITRECritical 9.8
The note-press plugin before 0.1.2 for WordPress has SQL injection.
Product
note-press
Fixed in
0.1.2
What to do
Update note-press to 0.1.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The olimometer plugin before 2.57 for WordPress has SQL injection.CVE-2016-10904 · WordPress plugins & themes · reported by MITRECritical 9.8
The olimometer plugin before 2.57 for WordPress has SQL injection.
Product
olimometer
Fixed in
2.57
What to do
Update olimometer to 2.57 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.CVE-2015-9326 · WordPress plugins & themes · reported by MITRECritical 9.8
The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.
Product
wp-business-intelligence-lite
Fixed in
1.6.3
What to do
Update wp-business-intelligence-lite to 1.6.3 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 16, 2019The visitors-online plugin before 0.4 for WordPress has SQL injection.CVE-2015-9325 · WordPress plugins & themes · reported by MITRECritical 9.8
The visitors-online plugin before 0.4 for WordPress has SQL injection.
Product
visitors-online
Fixed in
0.4
What to do
Update visitors-online to 0.4 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.CVE-2019-14789 · WordPress plugins & themes · reported by MITREMedium 6.1
The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.
Affected
3.2.8 to 3.2.8
What to do
Affects 3.2.8 to 3.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com
Aug 15, 2019wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultCVE-2019-14788 · WordPress plugins & themes · reported by MITREHigh 8.8
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters plugin before 4.6.19 for WordPress allows directory traversal with resultant remote PHP code execution via the subscribers[1][1] parameter in conjunction with an exportfile=../ value.
Product
wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters
Fixed in
4.6.19
What to do
Update wp-admin/admin-ajax.php?action=newsletters_exportmultiple in the Tribulant Newsletters to 4.6.19 or newer.
Full record and what to do →NVD record wordpress.org wpvulndb.com
Aug 15, 2019The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.CVE-2019-14786 · WordPress plugins & themes · reported by MITREMedium 6.5
The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.php reset-cmb parameter.
Fixed in
1.0.27.1
What to do
Update the plugin to 1.0.27.1 or newer.
Full record and what to do →NVD record rankmath.com wpvulndb.com
Aug 15, 2019The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.CVE-2019-14784 · WordPress plugins & themes · reported by MITREMedium 6.1
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
Product
CP Contact Form with PayPal
Fixed in
1.2.98
What to do
Update CP Contact Form with PayPal to 1.2.98 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 15, 2019A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress.CVE-2019-13578 · WordPress plugins & themes · reported by MITRECritical 9.8
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
Product
A SQL injection vulnerability exists in the Impress GiveWP Give
Affected
up to 2.5.0
What to do
Affects up to 2.5.0. Update A SQL injection vulnerability exists in the Impress GiveWP Give to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record fortiguard.com github.com
Aug 15, 2019The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-pCVE-2019-14800 · WordPress plugins & themes · reported by MITREMedium 5.3
The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI.
Product
FV Flowplayer Video Player
Fixed in
7.3.15.727
What to do
Update FV Flowplayer Video Player to 7.3.15.727 or newer.
Full record and what to do →NVD record wordpress.org pluginvulnerabilities.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.