Log in Get started
Live vulnerability tracking

WordPress security
alerts that matter

Get notified the moment a vulnerability is found in WordPress core, your plugins, or your theme. Free newsletter + personalised alerts for your sites.

Double opt-in · GDPR compliant · Unsubscribe anytime

Security overview Last 7 days
782
Critical
3045
High
6440
Medium
0
Subscribers
12407 total vulnerabilities tracked

Everything you need to stay secure

One platform for all WordPress security intelligence.

🔍
Site Scanner

Scan any WordPress site to detect installed plugins, themes and core version — then instantly check for known vulnerabilities.

📬
Daily Newsletter

Receive a curated daily digest of new WordPress vulnerabilities. Critical issues get their own immediate alert.

🎯
Personalized Alerts

Monitor your specific sites. Get an email only when a vulnerability affects plugins or themes you actually use.

🚫
Closed Plugin Tracker

Track plugins removed from the WordPress.org repository — often a sign of a serious security issue.

🔗
WP Plugin Integration

Install our free WordPress plugin on your site for automatic detection of all installed components — no manual URL entry.

🛡️
GDPR Compliant

Double opt-in, transparent data use, easy one-click unsubscribe. Your data stays in the EU. No tracking.

Latest vulnerabilities

Most recent WordPress security issues from all sources.

Scan your site →
—
Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute
UNKNOWN Plugin recipe-card-blocks-lite CVE-2026-115281 Fixed in 3.6.4 Oct 28, 2026
—
WP Roster < 2.35 - Unauthenticated Roster Member Deletion
UNKNOWN Plugin wp-roster CVE-2026-115255 Fixed in 2.35 Oct 28, 2026
—
Smart Popup by Supsystic < 2.0.2 - Unauthenticated SSRF via MailChimp Groups Lookup
UNKNOWN Plugin customer-engagement-system CVE-2026-115225 Fixed in 2.0.2 Oct 28, 2026
—
PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure
UNKNOWN Plugin payplug-for-woocommerce-official CVE-2026-113813 Fixed in 3.1.1 Oct 28, 2026
—
GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute
UNKNOWN Plugin geodirectory CVE-2026-113488 Fixed in 2.8.196 Oct 28, 2026
—
GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode
UNKNOWN Plugin geodirectory CVE-2026-113494 Fixed in 2.8.195 Oct 28, 2026
—
Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding
UNKNOWN Plugin customer-engagement-system CVE-2026-115224 Fixed in 2.0.2 Oct 28, 2026
—
MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute
UNKNOWN Plugin mp3-audio-player CVE-2026-111967 Fixed in 5.16 Oct 28, 2026
—
Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF
UNKNOWN Plugin media-library-assistant CVE-2026-113485 Fixed in 3.42 Oct 28, 2026
—
Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page
UNKNOWN Plugin royal-mcp CVE-2026-111961 Fixed in 1.5.10 Oct 28, 2026

Ready to secure your WordPress sites?

Create a free account to monitor your sites and get personalized vulnerability alerts.

Create free account Try the scanner