About this site
A daily-updated index of known vulnerabilities in WordPress plugins and themes, organized so you can check one plugin at a time. It is run by mgn, a company that builds and maintains WordPress sites.
What this site is for
Most WordPress compromises do not come from unknown attacks. They come from a plugin with a published fix that was never installed. The information needed to avoid that already exists — it is just spread across several databases and awkward to answer the one question that matters: is the version I am running affected, and what do I update to?
Every plugin and theme page here answers exactly that: which versions are affected, which release fixes it, whether the vulnerability is being exploited, and how likely exploitation is.
Ordered by how likely it is to be attacked, not by CVSS alone
CVSS describes how bad an exploit would be if it happened. It does not say whether anyone is actually exploiting it. Entries here are ordered by real-world signals first — confirmed exploitation (CISA KEV), then estimated exploit probability (EPSS) — and by severity after that.
What is not here
Vulnerabilities in software the public databases do not cover, and vulnerabilities in code that is unique to one site (a custom theme, bespoke plugins). Nothing here tells you whether your site is affected — only whether a given version of a given plugin is.
Descriptions are reproduced from the source records without translation or rewriting. Summarizing a vulnerability in different words is a good way to change what it means.
Where the data comes from
| Source | What it provides |
|---|---|
| NVD (NIST National Vulnerability Database) | The vulnerability records themselves: CVE id, CVSS severity, affected versions, fixed version |
| Wordfence Intelligence | WordPress-specific vulnerability records, including many that never receive a CVE id |
| WordPress.org API | Confirming a plugin or theme exists, its latest version, active installs and last update |
| CISA KEV | Vulnerabilities a government agency has confirmed as exploited in the wild |
| EPSS (FIRST.org) | Estimated probability that a vulnerability will be exploited in the next 30 days |
| WPVulnerability | Vulnerabilities in WordPress core, which the other sources classify differently |
How it is updated
The data is refreshed once a day by an automated pipeline: fetch, cross-check against wordpress.org, rebuild, publish. No AI writes or edits any of it — the records are reproduced as published, and the ordering is computed from the scores.
The date of the most recent data import is shown in the site header.
Accuracy
This site is compiled automatically from public databases and can be wrong or out of date. It is not a substitute for the vendor advisory. Before acting on anything here, confirm it against the source record linked on the page.
Found an error? Please tell us through the contact form.