WordPress vulnerability checker
Built for agencies and MSPs: KEV-first triage, core version series pages, and an installed-version scan against stored affected ranges. Plugin/theme CVEs still need their own version strings — core alone is incomplete.
Known exploited (KEV)
- Critical9.8PHPMailer Command Injection VulnerabilityPatch nowKEVEPSS 99.71%Dec 30, 2016
- Critical9.3WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityPatch nowKEVEPSS 98.53%Apr 28, 2026
- UnknownBackup Migration plugin for WordPress Remote Code ExecutionPatch nowKEVEPSS 97.85%Dec 16, 2023
- High7.5WordPress Snap Creek Duplicator Plugin File Download VulnerabilityPatch nowKEVEPSS 97.82%Apr 13, 2020
- UnknownWordPress wordpress Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 97.80%Dec 23, 2023
- Critical9.8WordPress File Manager Plugin Remote Code Execution VulnerabilityPatch nowKEVEPSS 97.33%Sep 9, 2020
- Unknownidangero chop_slider Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 95.66%Apr 27, 2024
- Unknownrevmakx backup_and_staging_by_wp_time_capsule Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 94.14%Mar 19, 2025
Recently published
- High7.7The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter befor…Open the advisoryOct 18, 2026
- Medium5.3The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, acceptin…Open the advisoryOct 18, 2026
- Medium4.9The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targe…Open the advisoryOct 18, 2026
- High7.1The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on…Open the advisoryOct 18, 2026
- Medium4.9The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an a…Open the advisoryOct 18, 2026
- Medium6.5The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authentic…Open the advisoryOct 18, 2026
- Medium4.3The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data…Open the advisoryOct 18, 2026
- Medium4.3The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a su…Open the advisoryOct 18, 2026