Log in Get started
Live vulnerability tracking

WordPress security
alerts that matter

Get notified the moment a vulnerability is found in WordPress core, your plugins, or your theme. Free newsletter + personalised alerts for your sites.

Double opt-in · GDPR compliant · Unsubscribe anytime

Security overview Last 7 days
786
Critical
3071
High
6564
Medium
0
Subscribers
12517 total vulnerabilities tracked

Everything you need to stay secure

One platform for all WordPress security intelligence.

🔍
Site Scanner

Scan any WordPress site to detect installed plugins, themes and core version — then instantly check for known vulnerabilities.

📬
Daily Newsletter

Receive a curated daily digest of new WordPress vulnerabilities. Critical issues get their own immediate alert.

🎯
Personalized Alerts

Monitor your specific sites. Get an email only when a vulnerability affects plugins or themes you actually use.

🚫
Closed Plugin Tracker

Track plugins removed from the WordPress.org repository — often a sign of a serious security issue.

🔗
WP Plugin Integration

Install our free WordPress plugin on your site for automatic detection of all installed components — no manual URL entry.

🛡️
GDPR Compliant

Double opt-in, transparent data use, easy one-click unsubscribe. Your data stays in the EU. No tracking.

Latest vulnerabilities

Most recent WordPress security issues from all sources.

Scan your site →
—
Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form
UNKNOWN Plugin community-events CVE-2026-86794 Fixed in 1.6.0 Oct 29, 2026
—
YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax
UNKNOWN Plugin video-player-for-youtube CVE-2026-85007 Fixed in 2.1.4 Oct 29, 2026
—
Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR
UNKNOWN Plugin photo-engine-media-organizer-lightroom CVE-2026-115259 Fixed in 6.6.0 Oct 29, 2026
—
Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload
UNKNOWN Plugin chat-ai-with-dispatcher CVE-2026-115245 Fixed in 2.4 Oct 29, 2026
—
Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal
UNKNOWN Plugin automated-import-products-to-cart CVE-2026-113617 Fixed in 1.0.4 Oct 29, 2026
—
WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF
UNKNOWN Plugin wp-photo-album-plus CVE-2026-110983 Fixed in 9.3.04.004 Oct 29, 2026
—
Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter
UNKNOWN Plugin two-factor-authentication CVE-2026-111739 Fixed in 1.17.0 Oct 29, 2026
—
GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure
UNKNOWN Plugin geodirectory CVE-2026-114270 Fixed in 2.8.197 Oct 29, 2026
—
LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset
UNKNOWN Plugin logixfast-auth CVE-2026-113616 Fixed in 1.0.4 Oct 29, 2026
—
WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
UNKNOWN Plugin wp-post-author CVE-2026-108685 Fixed in 4.2.0 Oct 29, 2026

Recently removed from WordPress.org

These plugins were closed/removed from the repository.

🚫
gravity-forms-pdf-extended

Author Request

Detected: Oct 28, 2026

Ready to secure your WordPress sites?

Create a free account to monitor your sites and get personalized vulnerability alerts.

Create free account Try the scanner