Log in Get started
Live vulnerability tracking

WordPress security
alerts that matter

Get notified the moment a vulnerability is found in WordPress core, your plugins, or your theme. Free newsletter + personalised alerts for your sites.

Double opt-in · GDPR compliant · Unsubscribe anytime

Security overview Last 7 days
862
Critical
3307
High
7087
Medium
0
Subscribers
13432 total vulnerabilities tracked

Everything you need to stay secure

One platform for all WordPress security intelligence.

🔍
Site Scanner

Scan any WordPress site to detect installed plugins, themes and core version — then instantly check for known vulnerabilities.

📬
Daily Newsletter

Receive a curated daily digest of new WordPress vulnerabilities. Critical issues get their own immediate alert.

🎯
Personalized Alerts

Monitor your specific sites. Get an email only when a vulnerability affects plugins or themes you actually use.

🚫
Closed Plugin Tracker

Track plugins removed from the WordPress.org repository — often a sign of a serious security issue.

🔗
WP Plugin Integration

Install our free WordPress plugin on your site for automatic detection of all installed components — no manual URL entry.

🛡️
GDPR Compliant

Double opt-in, transparent data use, easy one-click unsubscribe. Your data stays in the EU. No tracking.

Latest vulnerabilities

Most recent WordPress security issues from all sources.

Scan your site →
—
Komfortkasse for WooCommerce < 1.4.9 - Administrator Account Creation via CSRF
UNKNOWN Plugin komfortkasse-for-woocommerce CVE-2026-122001 Fixed in 1.4.9 Nov 7, 2026
—
Exsile SMS Gateway < 2.0.0 - Subscriber+ Privilege Escalation via Arbitrary Option Update
UNKNOWN Plugin ileads-sms-gateway-by-exsile CVE-2026-121866 Fixed in 2.0.0 Nov 7, 2026
—
Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables Search
UNKNOWN Plugin event-tickets-with-ticket-scanner CVE-2026-121858 Fixed in 3.2.9 Nov 7, 2026
—
Magic Link < 2.2.6 - Subscriber+ Privilege Escalation via Magic Link Generation
UNKNOWN Plugin magic-link CVE-2026-121848 Fixed in 2.2.6 Nov 7, 2026
—
Fiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_update
UNKNOWN Plugin fiber-admin CVE-2026-121492 Fixed in 4.0.1 Nov 7, 2026
—
Add From Server Reloaded < 6.0.0 - Author+ Stored XSS via SVG Upload
UNKNOWN Plugin add-from-server-lite CVE-2026-121796 Fixed in 6.0.0 Nov 7, 2026
—
Event Tickets with Ticket Scanner < 3.1.14 - Authenticated Ticket Data Disclosure and Removal via executeWCBackend
UNKNOWN Plugin event-tickets-with-ticket-scanner CVE-2026-121857 Fixed in 3.1.14 Nov 7, 2026
—
Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion
UNKNOWN Plugin tournamatch CVE-2026-121379 Fixed in 4.7.1 Nov 7, 2026
—
Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR
UNKNOWN Plugin directorist-ai-powered-business-directory-listings-classified-ads CVE-2026-118534 Fixed in 8.11 Nov 7, 2026
—
Live Composer < 2.1.23 - Contributor+ Stored XSS via Post Module Pagination
UNKNOWN Plugin live-composer CVE-2026-119073 Fixed in 2.1.23 Nov 7, 2026

Recently removed from WordPress.org

These plugins were closed/removed from the repository.

🚫
gravity-forms-pdf-extended

Author Request

Detected: Oct 28, 2026

Ready to secure your WordPress sites?

Create a free account to monitor your sites and get personalized vulnerability alerts.

Create free account Try the scanner