Log in Get started
Live vulnerability tracking

WordPress security
alerts that matter

Get notified the moment a vulnerability is found in WordPress core, your plugins, or your theme. Free newsletter + personalised alerts for your sites.

Double opt-in · GDPR compliant · Unsubscribe anytime

Security overview Last 7 days
775
Critical
3017
High
6344
Medium
0
Subscribers
12175 total vulnerabilities tracked

Everything you need to stay secure

One platform for all WordPress security intelligence.

🔍
Site Scanner

Scan any WordPress site to detect installed plugins, themes and core version — then instantly check for known vulnerabilities.

📬
Daily Newsletter

Receive a curated daily digest of new WordPress vulnerabilities. Critical issues get their own immediate alert.

🎯
Personalized Alerts

Monitor your specific sites. Get an email only when a vulnerability affects plugins or themes you actually use.

🚫
Closed Plugin Tracker

Track plugins removed from the WordPress.org repository — often a sign of a serious security issue.

🔗
WP Plugin Integration

Install our free WordPress plugin on your site for automatic detection of all installed components — no manual URL entry.

🛡️
GDPR Compliant

Double opt-in, transparent data use, easy one-click unsubscribe. Your data stays in the EU. No tracking.

Latest vulnerabilities

Most recent WordPress security issues from all sources.

Scan your site →
—
Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade
UNKNOWN Plugin duplicator CVE-2026-115251 Fixed in 5.0.0 Oct 25, 2026
—
Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers
UNKNOWN Plugin datawiza-proxy-auth-plugin CVE-2026-115214 Fixed in 1.1.1 Oct 25, 2026
—
WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR
UNKNOWN Plugin wpvr CVE-2026-114742 Fixed in 9.0.3 Oct 25, 2026
—
WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard
UNKNOWN Plugin wpvr CVE-2026-114740 Fixed in 9.1.3 Oct 25, 2026
—
WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR
UNKNOWN Plugin wpvr CVE-2026-114741 Fixed in 9.0.3 Oct 25, 2026
—
InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings
UNKNOWN Plugin instawp-connect CVE-2026-114743 Fixed in 0.1.4.2 Oct 25, 2026
—
Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget
UNKNOWN Plugin qi-addons-for-elementor CVE-2026-115183 Fixed in 1.11.2 Oct 25, 2026
—
GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant
UNKNOWN Plugin givewp CVE-2026-111980 Fixed in 4.19.0.1 Oct 25, 2026
—
GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route
UNKNOWN Plugin givewp CVE-2026-111976 Fixed in 4.19.0.1 Oct 25, 2026
—
GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import
UNKNOWN Plugin givewp CVE-2026-111978 Fixed in 4.19.0.1 Oct 25, 2026

Ready to secure your WordPress sites?

Create a free account to monitor your sites and get personalized vulnerability alerts.

Create free account Try the scanner