Compare your installed software with the affected versions below. Follow the source’s remediation guidance and test an available update after taking a backup. A database entry describes a reported issue; it does not establish whether a particular website has been compromised.
WordPress security intelligence
WordPress vulnerability database
Find reported security issues in WordPress plugins, themes and core. Review affected versions, available fixes and the original research before deciding what to update.
Get help with a vulnerable WordPress site
A BugShield developer can review the report, check your installed version and help you apply the right fix.
Get WordPress helpQuestions about WordPress vulnerabilities
What is a WordPress vulnerability?
A vulnerability is a security flaw in WordPress, a plugin or a theme. Someone can use it to access information or make changes they should not be allowed to make. Each report lists the affected versions and explains the issue.
Does a listed vulnerability mean my website has been hacked?
No. A report describes a security flaw, not evidence that someone has used it on your website. Compare the affected versions with the version you have installed, then follow the advice in the original report.
How do I check my plugin or theme version?
In your WordPress dashboard, open Plugins > Installed Plugins to find each plugin's version. For a theme, go to Appearance > Themes and open Theme Details. You can find your WordPress version under Dashboard > Updates.
What should I do if my version is affected?
Read the original report and check which version contains the fix. Back up your website before updating, and test the update on a staging copy if you have one. When no fix is available, ask the developer or your website support team whether to disable or replace the affected plugin or theme.
Where do the vulnerability reports come from?
The database currently uses reports from Wordfence Intelligence. Each entry links to its source and lists affected versions and available fixes. BugShield brings those reports together so you can search them by name, category and severity.
What does a CVE ID mean?
A CVE ID is a reference number for a publicly reported security flaw, such as CVE-2026-12345. It helps you find reports about the same issue across different websites. You can paste a CVE ID into the search box, although some reports do not have one.
Is my website safe if there are no matching results?
An empty search means we have no matching published report in this database. It does not confirm that your website is secure or scan your installation for signs of a break-in. Keep WordPress, plugins and themes updated, including those with no listed vulnerabilities.