Log in Get started
Live vulnerability tracking

WordPress security
alerts that matter

Get notified the moment a vulnerability is found in WordPress core, your plugins, or your theme. Free newsletter + personalised alerts for your sites.

Double opt-in · GDPR compliant · Unsubscribe anytime

Security overview Last 7 days
841
Critical
3246
High
6973
Medium
0
Subscribers
13224 total vulnerabilities tracked

Everything you need to stay secure

One platform for all WordPress security intelligence.

🔍
Site Scanner

Scan any WordPress site to detect installed plugins, themes and core version — then instantly check for known vulnerabilities.

📬
Daily Newsletter

Receive a curated daily digest of new WordPress vulnerabilities. Critical issues get their own immediate alert.

🎯
Personalized Alerts

Monitor your specific sites. Get an email only when a vulnerability affects plugins or themes you actually use.

🚫
Closed Plugin Tracker

Track plugins removed from the WordPress.org repository — often a sign of a serious security issue.

🔗
WP Plugin Integration

Install our free WordPress plugin on your site for automatic detection of all installed components — no manual URL entry.

🛡️
GDPR Compliant

Double opt-in, transparent data use, easy one-click unsubscribe. Your data stays in the EU. No tracking.

Latest vulnerabilities

Most recent WordPress security issues from all sources.

Scan your site →
—
GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi
UNKNOWN Plugin gs-jwt-authentication-for-wp-rest-api CVE-2026-113615 Nov 6, 2026
—
Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection
UNKNOWN Plugin advanced-custom-fields-acf CVE-2026-110813 Fixed in 6.8.11 Nov 6, 2026
—
GutenKit 2.5.0 - 2.5.4 - Author+ Stored XSS via Page Settings Custom CSS
UNKNOWN Plugin gutenkit CVE-2026-114427 Fixed in 2.5.5 Nov 6, 2026
—
WHIZZ <= 1.1.8 - Unauthenticated Arbitrary User Password Reset
UNKNOWN Plugin whizz CVE-2026-115230 Nov 6, 2026
—
MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent
UNKNOWN Plugin mcb CVE-2026-110525 Nov 6, 2026
—
Mail Mage <= 0.0.25 - Unauthenticated SQLi via 'ewp_unsubscribe' Parameter
UNKNOWN Plugin mail-mage CVE-2026-110532 Nov 6, 2026
—
Real Estate Website Builder <= 1.4.3 - Unauthenticated Account Takeover via User Email Update
UNKNOWN Plugin placester CVE-2026-113584 Nov 6, 2026
—
Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass
UNKNOWN Plugin wurdey CVE-2026-110955 Nov 6, 2026
—
WP PageNavi Style <= 1.4 - Stored XSS via CSRF
UNKNOWN Plugin wp-pagenavi-style CVE-2026-109150 Nov 5, 2026
—
Dokan < 5.3.3 - Unauthenticated Email Sender Spoofing via Store Contact Form
UNKNOWN Plugin dokan-ai-powered-woocommerce-multivendor-marketplace-solution CVE-2026-107774 Fixed in 5.3.3 Nov 5, 2026

Recently removed from WordPress.org

These plugins were closed/removed from the repository.

🚫
gravity-forms-pdf-extended

Author Request

Detected: Oct 28, 2026

Ready to secure your WordPress sites?

Create a free account to monitor your sites and get personalized vulnerability alerts.

Create free account Try the scanner