Log in Get started
Live vulnerability tracking

WordPress security
alerts that matter

Get notified the moment a vulnerability is found in WordPress core, your plugins, or your theme. Free newsletter + personalised alerts for your sites.

Double opt-in · GDPR compliant · Unsubscribe anytime

Security overview Last 7 days
870
Critical
3322
High
7140
Medium
0
Subscribers
13524 total vulnerabilities tracked

Everything you need to stay secure

One platform for all WordPress security intelligence.

🔍
Site Scanner

Scan any WordPress site to detect installed plugins, themes and core version — then instantly check for known vulnerabilities.

📬
Daily Newsletter

Receive a curated daily digest of new WordPress vulnerabilities. Critical issues get their own immediate alert.

🎯
Personalized Alerts

Monitor your specific sites. Get an email only when a vulnerability affects plugins or themes you actually use.

🚫
Closed Plugin Tracker

Track plugins removed from the WordPress.org repository — often a sign of a serious security issue.

🔗
WP Plugin Integration

Install our free WordPress plugin on your site for automatic detection of all installed components — no manual URL entry.

🛡️
GDPR Compliant

Double opt-in, transparent data use, easy one-click unsubscribe. Your data stays in the EU. No tracking.

Latest vulnerabilities

Most recent WordPress security issues from all sources.

Scan your site →
—
Userplace <= 1.2.0 - Unauthenticated Privilege Escalation
UNKNOWN Plugin userplace CVE-2026-110963 Nov 8, 2026
—
Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and Modification
UNKNOWN Plugin sync-post-with-other-site CVE-2026-110132 Fixed in 1.9.4 Nov 8, 2026
—
Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare Handlers
UNKNOWN Plugin productive-commerce CVE-2026-109925 Fixed in 1.1.54 Nov 8, 2026
—
Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force
UNKNOWN Plugin ecommerce-affiliate CVE-2026-106015 Nov 8, 2026
—
BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation
UNKNOWN Plugin thanh-to-n-qu-t-m-qr-code-t-ng CVE-2026-105970 Nov 8, 2026
—
Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook
UNKNOWN Plugin razorpay-for-woocommerce CVE-2026-104639 Fixed in 4.8.9 Nov 8, 2026
—
BackUpWordPress < 3.15 - Subscriber+ Backup Directory File Deletion via hmbkp_dismiss_error
UNKNOWN Plugin backupwordpress CVE-2026-104307 Fixed in 3.15 Nov 8, 2026
—
Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background Setting
UNKNOWN Plugin turisbook-booking-system CVE-2026-103303 Nov 8, 2026
—
Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon Apply
UNKNOWN Plugin razorpay-for-woocommerce CVE-2026-104337 Fixed in 4.8.9 Nov 8, 2026
—
Pie Register <= 3.8.4.15 - Contributor+ Invitation Code Modification
UNKNOWN Plugin pie-register CVE-2026-96963 Nov 8, 2026

Recently removed from WordPress.org

These plugins were closed/removed from the repository.

🚫
gravity-forms-pdf-extended

Author Request

Detected: Oct 28, 2026

Ready to secure your WordPress sites?

Create a free account to monitor your sites and get personalized vulnerability alerts.

Create free account Try the scanner