Log in Get started
Live vulnerability tracking

WordPress security
alerts that matter

Get notified the moment a vulnerability is found in WordPress core, your plugins, or your theme. Free newsletter + personalised alerts for your sites.

Double opt-in · GDPR compliant · Unsubscribe anytime

Security overview Last 7 days
743
Critical
2798
High
5827
Medium
0
Subscribers
11310 total vulnerabilities tracked

Everything you need to stay secure

One platform for all WordPress security intelligence.

🔍
Site Scanner

Scan any WordPress site to detect installed plugins, themes and core version — then instantly check for known vulnerabilities.

📬
Daily Newsletter

Receive a curated daily digest of new WordPress vulnerabilities. Critical issues get their own immediate alert.

🎯
Personalized Alerts

Monitor your specific sites. Get an email only when a vulnerability affects plugins or themes you actually use.

🚫
Closed Plugin Tracker

Track plugins removed from the WordPress.org repository — often a sign of a serious security issue.

🔗
WP Plugin Integration

Install our free WordPress plugin on your site for automatic detection of all installed components — no manual URL entry.

🛡️
GDPR Compliant

Double opt-in, transparent data use, easy one-click unsubscribe. Your data stays in the EU. No tracking.

Latest vulnerabilities

Most recent WordPress security issues from all sources.

Scan your site →
—
Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode
UNKNOWN Plugin donation-thermometer CVE-2026-92409 Fixed in 2.3.0 Oct 14, 2026
—
YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion
UNKNOWN Plugin yith-woocommerce-popup CVE-2026-92426 Fixed in 1.60.0 Oct 14, 2026
—
Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed
UNKNOWN Plugin robokassa-payment-gateway-for-woocommerce CVE-2026-91076 Fixed in 1.9.0 Oct 14, 2026
—
SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter
UNKNOWN Plugin sellkit CVE-2026-94254 Fixed in 2.8.0 Oct 14, 2026
—
Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints
UNKNOWN Plugin tainacan CVE-2026-90989 Fixed in 1.4.0 Oct 14, 2026
—
Fast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter
UNKNOWN Plugin fast-courier CVE-2026-89288 Fixed in 5.2.4 Oct 14, 2026
—
WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR
UNKNOWN Plugin wp-2fa CVE-2026-108066 Fixed in 4.2.0 Oct 14, 2026
—
Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon
UNKNOWN Plugin gutenverse-form CVE-2026-106469 Fixed in 3.0.11 Oct 14, 2026
—
CVE-2026-92426 — The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the reque
UNKNOWN Plugin CVE-2026-92426 Oct 14, 2026
—
CVE-2026-92409 — The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a s
UNKNOWN Plugin CVE-2026-92409 Oct 14, 2026

Ready to secure your WordPress sites?

Create a free account to monitor your sites and get personalized vulnerability alerts.

Create free account Try the scanner