The archive
Monthly plugin CVE roundups
Newest first. Each edition covers the month's most exploitable WordPress plugin disclosures — with CVSS scores, affected install counts, patch status, and a three-step response.
How we track
Signal, not noise
Hundreds of WordPress CVEs are published every month. We surface only the ones that actually put real sites at risk — and translate them into plain-English action.
We triage by impact
Every month we review disclosures from Patchstack, Wordfence and WPScan and keep the ones with critical or high severity, real-world exploitation, or large install bases.
We give the numbers
CVE identifier, CVSS score, affected plugin and version range, install count, and whether a patch exists yet — so you can judge your own exposure in seconds.
We tell you what to do
Each entry ends with a clear three-step response — update, mitigate, or remove — plus what to watch for next month. No jargon, no fear-mongering.