Log in Get started
Live vulnerability tracking

WordPress security
alerts that matter

Get notified the moment a vulnerability is found in WordPress core, your plugins, or your theme. Free newsletter + personalised alerts for your sites.

Double opt-in · GDPR compliant · Unsubscribe anytime

Security overview Last 7 days
825
Critical
3215
High
6910
Medium
0
Subscribers
13111 total vulnerabilities tracked

Everything you need to stay secure

One platform for all WordPress security intelligence.

🔍
Site Scanner

Scan any WordPress site to detect installed plugins, themes and core version — then instantly check for known vulnerabilities.

📬
Daily Newsletter

Receive a curated daily digest of new WordPress vulnerabilities. Critical issues get their own immediate alert.

🎯
Personalized Alerts

Monitor your specific sites. Get an email only when a vulnerability affects plugins or themes you actually use.

🚫
Closed Plugin Tracker

Track plugins removed from the WordPress.org repository — often a sign of a serious security issue.

🔗
WP Plugin Integration

Install our free WordPress plugin on your site for automatic detection of all installed components — no manual URL entry.

🛡️
GDPR Compliant

Double opt-in, transparent data use, easy one-click unsubscribe. Your data stays in the EU. No tracking.

Latest vulnerabilities

Most recent WordPress security issues from all sources.

Scan your site →
—
WP PageNavi Style <= 1.4 - Stored XSS via CSRF
UNKNOWN Plugin wp-pagenavi-style CVE-2026-109150 Nov 5, 2026
—
Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint
UNKNOWN Plugin dokan-ai-powered-woocommerce-multivendor-marketplace-solution CVE-2026-107773 Fixed in 5.3.3 Nov 5, 2026
—
CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge
UNKNOWN Plugin catfolders CVE-2026-107787 Fixed in 2.5.7 Nov 5, 2026
—
CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting
UNKNOWN Plugin catfolders CVE-2026-107786 Fixed in 2.5.7 Nov 5, 2026
—
Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation
UNKNOWN Plugin dokan-ai-powered-woocommerce-multivendor-marketplace-solution CVE-2026-107775 Fixed in 5.3.3 Nov 5, 2026
—
Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form
UNKNOWN Plugin dokan-ai-powered-woocommerce-multivendor-marketplace-solution CVE-2026-107774 Fixed in 5.3.3 Nov 5, 2026
—
Car Dealer <= 4.73 - Unauthenticated Private/Draft/Pending Post Content Disclosure via cardealer_single_car_ajax
UNKNOWN Plugin car-dealer-dealership-and-vehicle-sales CVE-2026-105971 Nov 5, 2026
—
Cloud Blocks <= 1.1.8 - Unauthenticated Stored XSS
UNKNOWN Plugin cloud-blocks CVE-2025-15702 Nov 5, 2026
—
IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter
UNKNOWN Plugin ivpay-payments CVE-2026-100144 Nov 5, 2026
—
Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload
UNKNOWN Plugin easy-social-icons CVE-2026-105259 Fixed in 4.0.3 Nov 5, 2026

Recently removed from WordPress.org

These plugins were closed/removed from the repository.

🚫
gravity-forms-pdf-extended

Author Request

Detected: Oct 28, 2026

Ready to secure your WordPress sites?

Create a free account to monitor your sites and get personalized vulnerability alerts.

Create free account Try the scanner