Log in Get started
Live vulnerability tracking

WordPress security
alerts that matter

Get notified the moment a vulnerability is found in WordPress core, your plugins, or your theme. Free newsletter + personalised alerts for your sites.

Double opt-in · GDPR compliant · Unsubscribe anytime

Security overview Last 7 days
798
Critical
3097
High
6627
Medium
0
Subscribers
12604 total vulnerabilities tracked

Everything you need to stay secure

One platform for all WordPress security intelligence.

🔍
Site Scanner

Scan any WordPress site to detect installed plugins, themes and core version — then instantly check for known vulnerabilities.

📬
Daily Newsletter

Receive a curated daily digest of new WordPress vulnerabilities. Critical issues get their own immediate alert.

🎯
Personalized Alerts

Monitor your specific sites. Get an email only when a vulnerability affects plugins or themes you actually use.

🚫
Closed Plugin Tracker

Track plugins removed from the WordPress.org repository — often a sign of a serious security issue.

🔗
WP Plugin Integration

Install our free WordPress plugin on your site for automatic detection of all installed components — no manual URL entry.

🛡️
GDPR Compliant

Double opt-in, transparent data use, easy one-click unsubscribe. Your data stays in the EU. No tracking.

Latest vulnerabilities

Most recent WordPress security issues from all sources.

Scan your site →
—
Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute
UNKNOWN Plugin firelight-lightbox CVE-2026-118165 Fixed in 2.3.23 Oct 30, 2026
—
BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification
UNKNOWN Plugin buddyforms CVE-2026-118101 Fixed in 2.10.1 Oct 30, 2026
—
BuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure
UNKNOWN Plugin buddyforms CVE-2026-118100 Fixed in 2.10.3 Oct 30, 2026
—
WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter
UNKNOWN Plugin wp-visitor-statistics-real-time-traffic CVE-2026-117572 Fixed in 8.8 Oct 30, 2026
—
WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter
UNKNOWN Plugin user-frontend CVE-2026-115277 Fixed in 4.3.14 Oct 30, 2026
—
WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters
UNKNOWN Plugin wp-visitor-statistics-real-time-traffic CVE-2026-117571 Fixed in 8.8 Oct 30, 2026
—
Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute
UNKNOWN Plugin joinchat CVE-2026-118071 Fixed in 6.4.2 Oct 30, 2026
—
Fraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer Blacklisting
UNKNOWN Plugin fraud-prevention-for-woocommerce-and-edd CVE-2026-118072 Fixed in 2.3.6 Oct 30, 2026
—
Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer
UNKNOWN Plugin security-plugin-firewall-malware-scanner-with-auto-removal CVE-2026-114444 Fixed in 2.191 Oct 30, 2026
—
Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer
UNKNOWN Plugin enable-media-replace CVE-2026-114422 Fixed in 4.2.3 Oct 30, 2026

Recently removed from WordPress.org

These plugins were closed/removed from the repository.

🚫
gravity-forms-pdf-extended

Author Request

Detected: Oct 28, 2026

Ready to secure your WordPress sites?

Create a free account to monitor your sites and get personalized vulnerability alerts.

Create free account Try the scanner