Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 12 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list
35added in the last 30 days
449new WordPress flaws this week
390,525entries in the database

10 results

  • Aug 24, 2026Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control VulnerabilityCVE-2026-21962 · Websites & servers · Oracle · reported by secalert_us@oracle.comExploitedCritical 10

    Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data.

    Product
    HTTP Server and Oracle Weblogic Server Proxy Plug-in
    On CISA’s list since
    Aug 24, 2026 (federal fix deadline Aug 27, 2026)
    What to do
    Attackers are using this now. Install Oracle’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogoracle.comgithub.com

  • Jun 15, 2026LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following VulnerabilityCVE-2026-54420 · Other software · LiteSpeed · reported by MITREExploitedHigh 8.5

    LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could allow a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS.

    Product
    cPanel Plugin
    On CISA’s list since
    Jun 15, 2026 (federal fix deadline Jun 18, 2026)
    What to do
    Attackers are using this now. Install LiteSpeed’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogblog.litespeedtech.comlitespeedtech.com

  • May 26, 2026LiteSpeed cPanel Plugin Privilege Escalation VulnerabilityCVE-2026-48172 · Other software · LiteSpeed · reported by MITREExploitedCritical 10

    LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.

    Product
    cPanel Plugin
    On CISA’s list since
    May 26, 2026 (federal fix deadline May 29, 2026)
    What to do
    Attackers are using this now. Install LiteSpeed’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogblog.litespeedtech.comlitespeedtech.com

  • Apr 25, 2022Jenkins Script Security Plugin Sandbox Bypass VulnerabilityCVE-2019-1003029 · Websites & servers · Jenkins · reported by jenkinsci-cert@googlegroups.comExploitedCritical 9.9

    Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.

    Product
    Script Security Plugin
    On CISA’s list since
    Apr 25, 2022 (federal fix deadline May 16, 2022)
    What to do
    Attackers are using this now. Install Jenkins’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comsecurityfocus.com

  • Mar 25, 2022Jenkins Matrix Project Plugin Remote Code Execution VulnerabilityCVE-2019-1003030 · Websites & servers · Jenkins · reported by jenkinsci-cert@googlegroups.comExploitedCritical 9.9

    Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.

    Product
    Matrix Project Plugin
    On CISA’s list since
    Mar 25, 2022 (federal fix deadline Apr 15, 2022)
    What to do
    Attackers are using this now. Install Jenkins’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comsecurityfocus.com

  • Mar 15, 2022Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation VulnerabilityCVE-2019-1405 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedRansomwareHigh 7.8

    A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.

    Product
    Windows
    On CISA’s list since
    Mar 15, 2022 (federal fix deadline Apr 5, 2022)
    What to do
    Attackers are using this now. Install Microsoft’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comportal.msrc.microsoft.com

  • Nov 3, 2021Apache Solr VelocityResponseWriter Plug-In Remote Code Execution VulnerabilityCVE-2019-17558 · Websites & servers · Apache · reported by security@apache.orgExploitedHigh 7.5

    The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.

    Product
    Solr
    On CISA’s list since
    Nov 3, 2021 (federal fix deadline May 3, 2022)
    What to do
    Attackers are using this now. Install Apache’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comissues.apache.org

  • Nov 3, 2021WordPress File Manager Plugin Remote Code Execution VulnerabilityCVE-2020-25213 · WordPress plugins & themes · reported by MITREExploitedCritical 10

    WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.

    Product
    File Manager Plugin
    Fixed in
    6.9
    On CISA’s list since
    Nov 3, 2021 (federal fix deadline May 3, 2022)
    What to do
    Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com

  • Nov 3, 2021WordPress Snap Creek Duplicator Plugin File Download VulnerabilityCVE-2020-11738 · WordPress plugins & themes · reported by MITREExploitedHigh 7.5

    WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.

    Product
    Snap Creek Duplicator Plugin
    Fixed in
    1.3.28
    On CISA’s list since
    Nov 3, 2021 (federal fix deadline May 3, 2022)
    What to do
    Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com

  • Nov 3, 2021WordPress Social Warfare Plugin Cross-Site Scripting (XSS) VulnerabilityCVE-2019-9978 · WordPress plugins & themes · reported by MITREExploitedMedium 6.1

    WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.

    Product
    Social Warfare Plugin
    Fixed in
    3.5.3
    On CISA’s list since
    Nov 3, 2021 (federal fix deadline May 3, 2022)
    What to do
    Attackers are using this now. Install WordPress’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.

    Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.