Log in Get started
Live vulnerability tracking

WordPress security
alerts that matter

Get notified the moment a vulnerability is found in WordPress core, your plugins, or your theme. Free newsletter + personalised alerts for your sites.

Double opt-in · GDPR compliant · Unsubscribe anytime

Security overview Last 7 days
767
Critical
2967
High
6253
Medium
0
Subscribers
11970 total vulnerabilities tracked

Everything you need to stay secure

One platform for all WordPress security intelligence.

🔍
Site Scanner

Scan any WordPress site to detect installed plugins, themes and core version — then instantly check for known vulnerabilities.

📬
Daily Newsletter

Receive a curated daily digest of new WordPress vulnerabilities. Critical issues get their own immediate alert.

🎯
Personalized Alerts

Monitor your specific sites. Get an email only when a vulnerability affects plugins or themes you actually use.

🚫
Closed Plugin Tracker

Track plugins removed from the WordPress.org repository — often a sign of a serious security issue.

🔗
WP Plugin Integration

Install our free WordPress plugin on your site for automatic detection of all installed components — no manual URL entry.

🛡️
GDPR Compliant

Double opt-in, transparent data use, easy one-click unsubscribe. Your data stays in the EU. No tracking.

Latest vulnerabilities

Most recent WordPress security issues from all sources.

Scan your site →
—
Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name
UNKNOWN Plugin photo-engine-media-organizer-lightroom CVE-2026-111971 Fixed in 6.5.8 Oct 22, 2026
—
WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
UNKNOWN Plugin webp-express CVE-2026-97328 Fixed in 0.25.16 Oct 22, 2026
—
MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment
UNKNOWN Plugin masterstudy-lms-wordpress-plugin CVE-2026-88849 Fixed in 3.7.55 Oct 22, 2026
—
Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR
UNKNOWN Plugin photo-engine-media-organizer-lightroom CVE-2026-111972 Fixed in 6.5.8 Oct 22, 2026
—
Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter
UNKNOWN Plugin link-library CVE-2026-78392 Fixed in 7.9.6 Oct 22, 2026
—
MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' Parameter
UNKNOWN Plugin mb-custom-post-types-custom-taxonomies CVE-2026-110010 Fixed in 2.12.3 Oct 22, 2026
—
Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token
UNKNOWN Plugin royal-mcp CVE-2026-111958 Fixed in 1.5.7 Oct 22, 2026
—
MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure via Export
UNKNOWN Plugin mb-custom-post-types-custom-taxonomies CVE-2026-110011 Fixed in 2.12.3 Oct 22, 2026
—
Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update
UNKNOWN Plugin infility-global CVE-2026-109931 Fixed in 2.16.25 Oct 22, 2026
—
CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role
UNKNOWN Plugin hipaa-forms CVE-2026-109927 Fixed in 3.3.2 Oct 22, 2026

Ready to secure your WordPress sites?

Create a free account to monitor your sites and get personalized vulnerability alerts.

Create free account Try the scanner