Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
4 results
Oct 29, 2026GeoDirectory: Does not honour post password protectionCVE-2026-114270 · WordPress plugins & themes · reported by WPScan
The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
- Product
- GeoDirectory
- Fixed in
- 2.8.197
- What to do
- Update GeoDirectory to 2.8.197 or newer.
Oct 29, 2026Hide Price Until Login: Does not restrict a guest-registration handler and does not honour the site's user-registration settingCVE-2026-110030 · WordPress plugins & themes · reported by WPScan
The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled.
- Product
- Hide Price Until Login
- Fixed in
- 1.1.2
- What to do
- Update Hide Price Until Login to 1.1.2 or newer.
Sep 20, 2026SAML Single Sign On: Does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress accountCVE-2026-82842 · WordPress plugins & themes · reported by WPScanHigh 8.1
The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.
- Product
- SAML Single Sign On
- Fixed in
- 6.0.0
- What to do
- Update SAML Single Sign On to 6.0.0 or newer.
Mar 5, 2026Honor: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-22419 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Honor honor allows PHP Local File Inclusion.This issue affects Honor: from n/a through <= 2.3.
- Product
- Honor
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update Honor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.