Plugin authors often fix security bugs without saying so, and no vulnerability database ever lists them. We now read every new WordPress plugin release ourselves, and publish what we find as free, openly licensed advisories.
The WordPress Plugin Vulnerabilities Other Scanners Miss Read More »
A padlock in the address bar only tells you a secure connection was made. TLS Health checks what sits behind it: outdated protocols, expired or mismatched certificates, weak ciphers, and known attacks, with an A to F grade for every WordPress site.
Introducing TLS Health: A Deep HTTPS Check for Your WordPress Site Read More »
A vulnerability scan tells you whether anything you installed is known to be broken. Site Security answers a different question: what is your WordPress site giving away right now. Here is what we found across 12,857 sites, and what the new A to F security grade measures.
Introducing Site Security: A Security Grade for Your WordPress Site Read More »
WPSec Premium is now priced per website: from €19/month for a single WordPress site, with steep volume discounts as you add more (25 sites ≈ €5 each, 100 sites ≈ €2.30 each). Existing subscriptions continue unchanged for their current term.
New WPSec Pricing: Pay Per WordPress Website, Not Per Plan Read More »
A clean vulnerability scan only tells you half the story. Here is what your WordPress attack surface is, why it matters even when every plugin is patched, and how WPSec’s Attack Surface Analysis shows you exactly where your sites are exposed.
Your WordPress Vulnerability Scan Came Back Clean. Are You Still Exposed? Read More »
Is WordPress secure? Learn about WordPress Core, plugin and theme security, hardening techniques, and how to protect your site from cyber attacks.
Is WordPress Secure? Read More »
Learn how to find vulnerabilities in WordPress plugins using static analysis tools like Semgrep and AI-powered code review with ChatGPT.
How to Find Vulnerabilities in WordPress Plugins with Static Analysis and AI Tools Read More »
With the Really Simple Security plugin, WordPress users can easily improve the security of their websites with features such as: However, in versions 9.0.0 to 9.1.1.1, an authentication bypass was discovered that, if exploited, would allow a threat actor to gain access to any user account, including administrative accounts. At the time of disclosure on
On April 30, 2025, a critical security vulnerability was publicly disclosed in the OttoKit: All-in-One Automation Platform (formerly SureTriggers) WordPress plugin. The flaw allows attackers to gain unauthorized administrative access to WordPress sites under specific conditions, and active exploitation has already begun. What’s the Risk? The vulnerability, tracked as CVE-2025-27007, enables two main attack scenarios:
Critical Vulnerability in OttoKit WordPress Plugin Actively Exploited Read More »
The WordPress Multilingual Plugin (WPML), with over 1,000,000 active installations, was vulnerable to Remote Code Execution (RCE) via a Server-Side Template Injection (SSTI) vulnerability in the Twig template engine. WPML is a premium plugin that provides automatic language translations to build multilingual websites, enabling users to view web pages in different languages. This vulnerability was
The Full Story of CVE-2024-6386: Remote Code Execution in WPML Read More »