Log in Get started
Live vulnerability tracking

WordPress security
alerts that matter

Get notified the moment a vulnerability is found in WordPress core, your plugins, or your theme. Free newsletter + personalised alerts for your sites.

Double opt-in · GDPR compliant · Unsubscribe anytime

Security overview Last 7 days
816
Critical
3189
High
6795
Medium
0
Subscribers
12865 total vulnerabilities tracked

Everything you need to stay secure

One platform for all WordPress security intelligence.

🔍
Site Scanner

Scan any WordPress site to detect installed plugins, themes and core version — then instantly check for known vulnerabilities.

📬
Daily Newsletter

Receive a curated daily digest of new WordPress vulnerabilities. Critical issues get their own immediate alert.

🎯
Personalized Alerts

Monitor your specific sites. Get an email only when a vulnerability affects plugins or themes you actually use.

🚫
Closed Plugin Tracker

Track plugins removed from the WordPress.org repository — often a sign of a serious security issue.

🔗
WP Plugin Integration

Install our free WordPress plugin on your site for automatic detection of all installed components — no manual URL entry.

🛡️
GDPR Compliant

Double opt-in, transparent data use, easy one-click unsubscribe. Your data stays in the EU. No tracking.

Latest vulnerabilities

Most recent WordPress security issues from all sources.

Scan your site →
—
Joinchat – Enhanced “click to chat” [creame-whatsapp-me] >= 6.3.2 - < 6.4.2
UNKNOWN Plugin creame-whatsapp-me CVE-2026-118071 Fixed in 6.4.2 Oct 30, 2026
—
Enable Media Replace [enable-media-replace] >= 4.1.4 - < 4.2.3
UNKNOWN Plugin enable-media-replace CVE-2026-114422 Fixed in 4.2.3 Oct 30, 2026
—
Page Builder by SiteOrigin [siteorigin-panels] < 2.38.0
UNKNOWN Plugin siteorigin-panels CVE-2026-110506 Fixed in 2.38.0 Oct 28, 2026
—
Page Builder by SiteOrigin [siteorigin-panels] < 2.38.0
UNKNOWN Plugin siteorigin-panels CVE-2026-110507 Fixed in 2.38.0 Oct 28, 2026
3.7
BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion
LOW Plugin buddyforms CVE-2026-118437 Fixed in 2.10.1 Oct 31, 2026
3.7
CVE-2026-118437 — The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownership before deleting gue
LOW Plugin CVE-2026-118437 Oct 31, 2026
3.7
EUVD-2026-114585 (CVE-2026-118437) — The BuddyForms WordPress plugin before 2.10.1 does not properly verify ownershi…
LOW Plugin CVE-2026-118437 Oct 31, 2026
3.7
CVE-2026-115303 — The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-v
LOW Plugin CVE-2026-115303 Oct 29, 2026
3.7
Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping
LOW Plugin contact-form-by-supsystic CVE-2026-115303 Fixed in 1.11.1 Oct 29, 2026
3.7
EUVD-2026-112675 (CVE-2026-115303) — The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/…
LOW Plugin CVE-2026-115303 Oct 29, 2026

Recently removed from WordPress.org

These plugins were closed/removed from the repository.

🚫
gravity-forms-pdf-extended

Author Request

Detected: Oct 28, 2026

Ready to secure your WordPress sites?

Create a free account to monitor your sites and get personalized vulnerability alerts.

Create free account Try the scanner