Log in Get started
Live vulnerability tracking

WordPress security
alerts that matter

Get notified the moment a vulnerability is found in WordPress core, your plugins, or your theme. Free newsletter + personalised alerts for your sites.

Double opt-in · GDPR compliant · Unsubscribe anytime

Security overview Last 7 days
820
Critical
3199
High
6822
Medium
0
Subscribers
13024 total vulnerabilities tracked

Everything you need to stay secure

One platform for all WordPress security intelligence.

🔍
Site Scanner

Scan any WordPress site to detect installed plugins, themes and core version — then instantly check for known vulnerabilities.

📬
Daily Newsletter

Receive a curated daily digest of new WordPress vulnerabilities. Critical issues get their own immediate alert.

🎯
Personalized Alerts

Monitor your specific sites. Get an email only when a vulnerability affects plugins or themes you actually use.

🚫
Closed Plugin Tracker

Track plugins removed from the WordPress.org repository — often a sign of a serious security issue.

🔗
WP Plugin Integration

Install our free WordPress plugin on your site for automatic detection of all installed components — no manual URL entry.

🛡️
GDPR Compliant

Double opt-in, transparent data use, easy one-click unsubscribe. Your data stays in the EU. No tracking.

Latest vulnerabilities

Most recent WordPress security issues from all sources.

Scan your site →
—
Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover
UNKNOWN Plugin premium-packages CVE-2026-118407 Fixed in 7.3.1 Nov 4, 2026
—
Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path
UNKNOWN Plugin stape-conversion-tracking CVE-2026-118422 Fixed in 2.3.11 Nov 4, 2026
—
EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override
UNKNOWN Plugin eventprime CVE-2026-118523 Fixed in 4.3.6.1 Nov 4, 2026
—
Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via [sdm_show_download_info] Shortcode
UNKNOWN Plugin simple-download-monitor CVE-2026-118637 Fixed in 4.1.3 Nov 4, 2026
—
All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute
UNKNOWN Plugin all-in-one-video-gallery CVE-2026-118783 Fixed in 5.0.0 Nov 4, 2026
—
VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks
UNKNOWN Plugin vikwidgetsloader CVE-2026-118983 Fixed in 1.12.3 Nov 4, 2026
—
WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting
UNKNOWN Plugin wpvivid-backup-migration-staging CVE-2026-115426 Fixed in 0.9.138 Nov 4, 2026
—
Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR
UNKNOWN Plugin premium-packages CVE-2026-118404 Fixed in 7.3.1 Nov 4, 2026
—
Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure
UNKNOWN Plugin premium-packages CVE-2026-118403 Fixed in 7.3.1 Nov 4, 2026
—
Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore
UNKNOWN Plugin duplicator CVE-2026-115262 Fixed in 5.1.0 Nov 4, 2026

Recently removed from WordPress.org

These plugins were closed/removed from the repository.

🚫
gravity-forms-pdf-extended

Author Request

Detected: Oct 28, 2026

Ready to secure your WordPress sites?

Create a free account to monitor your sites and get personalized vulnerability alerts.

Create free account Try the scanner