Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list
35added in the last 30 days
575new WordPress flaws this week
391,358entries in the database

3,866 results · page 31 of 78

  • Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.3.8 versions.CVE-2026-42658 · WordPress plugins & themes · reported by PatchstackHigh 7.1

    Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.3.8 versions.

    Affected
    up to 5.3.8
    What to do
    Affects up to 5.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Other Vulnerability Type in Contest Gallery <= 28.1.7 versions.CVE-2026-42657 · WordPress plugins & themes · reported by PatchstackMedium 5.3

    Unauthenticated Other Vulnerability Type in Contest Gallery <= 28.1.7 versions.

    Affected
    up to 28.1.7
    What to do
    Affects up to 28.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Bypass Vulnerability in Best Payments Plugin for WP <= 4.6.19 versions.CVE-2026-42655 · WordPress plugins & themes · reported by PatchstackMedium 5.9

    Unauthenticated Bypass Vulnerability in Best Payments Plugin for WP <= 4.6.19 versions.

    Affected
    up to 4.6.19
    What to do
    Affects up to 4.6.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.6.7 versions.CVE-2026-42650 · WordPress plugins & themes · reported by PatchstackHigh 7.2

    Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.6.7 versions.

    Affected
    up to 5.6.7
    What to do
    Affects up to 5.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Favicon Rotator <= 1.2.11 versions.CVE-2026-42649 · WordPress plugins & themes · reported by PatchstackHigh 7.1

    Unauthenticated Cross Site Scripting (XSS) in Favicon Rotator <= 1.2.11 versions.

    Affected
    up to 1.2.11
    What to do
    Affects up to 1.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions.CVE-2026-42640 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions.

    Affected
    up to 5.3.8
    What to do
    Affects up to 5.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions.CVE-2026-42639 · WordPress plugins & themes · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions.

    Affected
    up to 3.6.2
    What to do
    Affects up to 3.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions.CVE-2026-42411 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions.

    Affected
    up to 1.4.7
    What to do
    Affects up to 1.4.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.CVE-2026-42386 · WordPress plugins & themes · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.

    Affected
    up to 4.5.1
    What to do
    Affects up to 4.5.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11.2 versions.CVE-2026-42384 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11.2 versions.

    What to do
    Update the plugin to the newest version.
  • Jun 15, 2026Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.CVE-2026-42381 · WordPress plugins & themes · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.

    Affected
    up to 3.15.0.1
    What to do
    Affects up to 3.15.0.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.CVE-2026-40799 · WordPress plugins & themes · reported by PatchstackMedium 5.3

    Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions.

    Affected
    up to 1.38.0
    What to do
    Affects up to 1.38.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.CVE-2026-40798 · WordPress plugins & themes · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.

    Affected
    up to 3.0.4
    What to do
    Affects up to 3.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions.CVE-2026-40791 · WordPress plugins & themes · reported by PatchstackHigh 7.1

    Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions.

    Affected
    up to 1.2.46
    What to do
    Affects up to 1.2.46. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions.CVE-2026-40789 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions.

    Affected
    up to 2.2
    What to do
    Affects up to 2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.CVE-2026-40787 · WordPress plugins & themes · reported by PatchstackHigh 7.1

    Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.

    Affected
    up to 11.0.0
    What to do
    Affects up to 11.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions.CVE-2026-40782 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions.

    Affected
    up to 2.3.0
    What to do
    Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Authentication in ReviewX <= 2.3.6 versions.CVE-2026-40781 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Authentication in ReviewX <= 2.3.6 versions.

    Affected
    up to 2.3.6
    What to do
    Affects up to 2.3.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.CVE-2026-40776 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.

    Affected
    up to 4.1.8
    What to do
    Affects up to 4.1.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions.CVE-2026-40775 · WordPress plugins & themes · reported by PatchstackHigh 7.3

    Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions.

    Affected
    up to 1.4.2
    What to do
    Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.CVE-2026-40774 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.

    Affected
    up to 1.7.06
    What to do
    Affects up to 1.7.06. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.CVE-2026-40772 · WordPress plugins & themes · reported by PatchstackCritical 10

    Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.

    Affected
    up to 1.2.2
    What to do
    Affects up to 1.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.CVE-2026-40771 · WordPress plugins & themes · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.

    Affected
    up to 28.1.6
    What to do
    Affects up to 28.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions.CVE-2026-40770 · WordPress plugins & themes · reported by PatchstackHigh 7.1

    Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions.

    Affected
    up to 7.5.3
    What to do
    Affects up to 7.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi &#8211; Save Entries, File Upload & Country Code Field <= 1.0.6 versions.CVE-2026-40769 · WordPress plugins & themes · reported by PatchstackHigh 8.6

    Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi &#8211; Save Entries, File Upload & Country Code Field <= 1.0.6 versions.

    Affected
    up to 1.0.6
    What to do
    Affects up to 1.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions.CVE-2026-40767 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions.

    What to do
    Update the plugin to the newest version.
  • Jun 15, 2026Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.CVE-2026-40762 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.

    What to do
    Update the plugin to the newest version.
  • Jun 15, 2026Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.CVE-2026-40743 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.

    Affected
    up to 3.9.7
    What to do
    Affects up to 3.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 versions.CVE-2026-40741 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 versions.

    Affected
    up to 7.0.0
    What to do
    Affects up to 7.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.CVE-2026-40732 · WordPress plugins & themes · reported by PatchstackHigh 7.1

    Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.

    Affected
    up to 3.5
    What to do
    Affects up to 3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.CVE-2026-39587 · WordPress plugins & themes · reported by PatchstackHigh 8.1

    Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.

    Affected
    up to 5.9.0
    What to do
    Affects up to 5.9.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.CVE-2026-39583 · WordPress plugins & themes · reported by PatchstackCritical 9.8

    Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.

    Affected
    up to 2.6.62
    What to do
    Affects up to 2.6.62. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.CVE-2026-39534 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.

    Affected
    up to 1.5.0
    What to do
    Affects up to 1.5.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions.CVE-2026-39533 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions.

    Affected
    up to 4.4.4
    What to do
    Affects up to 4.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.CVE-2026-39530 · WordPress plugins & themes · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.

    Affected
    up to 4.6.5
    What to do
    Affects up to 4.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.CVE-2026-39525 · WordPress plugins & themes · reported by PatchstackMedium 6.5

    Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.

    Affected
    up to 1.16.48.1
    What to do
    Affects up to 1.16.48.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.CVE-2026-39524 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.

    Affected
    up to 2.1.5
    What to do
    Affects up to 2.1.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.CVE-2026-39519 · WordPress plugins & themes · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.

    Affected
    up to 1.2.0
    What to do
    Affects up to 1.2.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.CVE-2026-39514 · WordPress plugins & themes · reported by PatchstackHigh 7.1

    Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.

    Affected
    up to 2.17.3
    What to do
    Affects up to 2.17.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.CVE-2026-39513 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.

    Affected
    up to 3.12.21
    What to do
    Affects up to 3.12.21. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.CVE-2026-39512 · WordPress plugins & themes · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.

    Affected
    up to 2.8.152
    What to do
    Affects up to 2.8.152. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.CVE-2026-39511 · WordPress plugins & themes · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.

    Affected
    up to 9.1.08.001
    What to do
    Affects up to 9.1.08.001. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.CVE-2026-39507 · WordPress plugins & themes · reported by PatchstackHigh 7.1

    Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.

    Affected
    up to 2.3.2
    What to do
    Affects up to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.CVE-2026-39503 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.

    Affected
    up to 3.6.5
    What to do
    Affects up to 3.6.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.CVE-2026-39502 · WordPress plugins & themes · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.

    Affected
    up to 1.15.38
    What to do
    Affects up to 1.15.38. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.CVE-2026-39493 · WordPress plugins & themes · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.

    Affected
    up to 1.6.9.27
    What to do
    Affects up to 1.6.9.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.CVE-2026-39492 · WordPress plugins & themes · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.

    Affected
    up to 4.9.1
    What to do
    Affects up to 4.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.CVE-2026-39480 · WordPress plugins & themes · reported by PatchstackHigh 7.5

    Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.

    Affected
    up to 2.1.1
    What to do
    Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.CVE-2026-39463 · WordPress plugins & themes · reported by PatchstackHigh 7.1

    Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.

    Affected
    up to 4.9.31
    What to do
    Affects up to 4.9.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
  • Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.CVE-2026-39451 · WordPress plugins & themes · reported by PatchstackMedium 6.3

    Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.

    Affected
    up to 18.0
    What to do
    Affects up to 18.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.