About these advisories

WPSec publishes security advisories for vulnerabilities in WordPress plugins. Each advisory describes the issue and lists the affected versions, the version that fixes it, its severity (CVSS 3.1) and its weakness type (CWE).

Every advisory concerns a plugin version with a fix available, so the advice is always to update to the fixed version or later. Advisories contain no exploit code. If another source later publishes the same vulnerability, the advisory says so.

Usage shows how common the plugin, and its affected versions, are among the WordPress sites WPSec scans: High, Medium, Low, or not seen. It is updated daily. No exact numbers are published.

Each advisory also links the plugin's page on our sister project WPSec AttackSurface, which maps a plugin's attack surface: its entry points, permission checks and risky code.

If you maintain one of these plugins and something here is wrong, contact us and we will correct it.

Data feeds

All published advisories are available as data, regenerated every hour:

• advisories.json: every advisory, with schema_version, generated_at, count, the advisories list and the ids in withdrawn.
• RSS feed: the 50 most recent advisories.
• Each advisory page also as advisory.json and index.md (Markdown) in the same folder, for example /vuln/WPSEC-2026-0001/advisory.json.
• index.md: the full list in Markdown, and the sitemap.

Fields of each advisory in the JSON:

• id, url, json_url, markdown_url: the advisory id (WPSEC-<year>-<number>, never reused) and its links.
• title, description, type, cwe, cve (usually empty: we do not request CVEs).
• plugin: slug, name, full_name, wordpress_org.
• cvss: version, score, vector, severity.
• affected: ranges (from, from_inclusive, to, to_inclusive) and a readable text; introduced_in, fixed_in, remediation.
• fix_released, published, updated (ISO 8601), also_published_as when another source published it later, and references.
• usage: plugin and affected_versions as High, Medium, Low or Not seen / None seen, among the sites WPSec scans, with the census date in as_of.
• attacksurface_url: the plugin on WPSec AttackSurface.
• license: name and url of the license (below). The top of advisories.json also says how to credit us, in license.attribution.

License

The advisories, meaning the text and data on these pages and in the feeds above, are licensed under the Creative Commons Attribution 4.0 International license (CC BY 4.0). You may copy, share and adapt them for any purpose, including in commercial products such as scanners and vulnerability databases, as long as you credit WPSec and link back:

• for one advisory, link to its page, for example: Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0001/
• for the whole dataset, link to this site: Vulnerability data from WPSec (https://wpsec.com/vuln/), CC BY 4.0

If you changed the text, say so. The license does not cover the WPSec name and logo, or the design of wpsec.com.

The information is provided as is, without warranty of any kind.