Log in Get started
Live vulnerability tracking

WordPress security
alerts that matter

Get notified the moment a vulnerability is found in WordPress core, your plugins, or your theme. Free newsletter + personalised alerts for your sites.

Double opt-in · GDPR compliant · Unsubscribe anytime

Security overview Last 7 days
908
Critical
3423
High
7331
Medium
0
Subscribers
13867 total vulnerabilities tracked

Everything you need to stay secure

One platform for all WordPress security intelligence.

🔍
Site Scanner

Scan any WordPress site to detect installed plugins, themes and core version — then instantly check for known vulnerabilities.

📬
Daily Newsletter

Receive a curated daily digest of new WordPress vulnerabilities. Critical issues get their own immediate alert.

🎯
Personalized Alerts

Monitor your specific sites. Get an email only when a vulnerability affects plugins or themes you actually use.

🚫
Closed Plugin Tracker

Track plugins removed from the WordPress.org repository — often a sign of a serious security issue.

🔗
WP Plugin Integration

Install our free WordPress plugin on your site for automatic detection of all installed components — no manual URL entry.

🛡️
GDPR Compliant

Double opt-in, transparent data use, easy one-click unsubscribe. Your data stays in the EU. No tracking.

Latest vulnerabilities

Most recent WordPress security issues from all sources.

Scan your site →
—
ProfilePress < 4.17.6 - Unauthenticated Restricted Content Disclosure via REST API
UNKNOWN Plugin profilepress CVE-2026-123656 Fixed in 4.17.6 Nov 11, 2026
—
CVE-2026-123656 — The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate some of its content pro
UNKNOWN Plugin CVE-2026-123656 Nov 11, 2026
0.0
EUVD-2026-123194 (CVE-2026-123656) — The ProfilePress WordPress plugin before 4.17.6 does not correctly evaluate so…
UNKNOWN Plugin CVE-2026-123656 Nov 11, 2026
—
Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 3.4.1
UNKNOWN Plugin limit-login-attempts-reloaded CVE-2026-118202 Fixed in 3.4.1 Nov 9, 2026
—
Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] >= 3.0.0 - < 3.4.1
UNKNOWN Plugin limit-login-attempts-reloaded CVE-2026-118201 Fixed in 3.4.1 Nov 9, 2026
—
MC4WP: Mailchimp for WordPress [mailchimp-for-wp] < 4.15.0
UNKNOWN Plugin mailchimp-for-wp CVE-2026-118167 Fixed in 4.15.0 Nov 6, 2026
3.7
Event Tickets < 5.30.3.1 - Unauthenticated Private Event Attendee Disclosure via post_status Filter Bypass in Attendees REST API
LOW Plugin event-tickets-and-registration CVE-2026-122087 Fixed in 5.30.3.1 Nov 11, 2026
2.2
Schema & Structured Data for WP & AMP < 1.70 - Contributor+ Structured Data Modification of Other Users' Posts via IDOR
LOW Plugin schema-structured-data-for-wp-amp CVE-2026-119033 Fixed in 1.70 Nov 11, 2026
2.7
Dynific Addons for Elementor 1.3 - Contributor+ Arbitrary Post Content Disclosure via dynific_template Shortcode
LOW Plugin dynific-addons-for-elementor-formerly-anywhere-elementor CVE-2026-117524 Fixed in 1.3.1 Nov 11, 2026
2.7
Smush < 4.3.6 - Author+ Optimization and Restoration of Others' Attachments via IDOR
LOW Plugin smush CVE-2026-118241 Fixed in 4.3.6 Nov 11, 2026

Recently removed from WordPress.org

These plugins were closed/removed from the repository.

🚫
advanced-ads

Closed by WordPress.org

Detected: Nov 11, 2026

🚫
gravity-forms-pdf-extended

Author Request

Detected: Oct 28, 2026

Ready to secure your WordPress sites?

Create a free account to monitor your sites and get personalized vulnerability alerts.

Create free account Try the scanner