blogsafe.org My Downloads

BlogSafe.org

WordPress Security Tools, Research, and Recovery

Diagnostics, vulnerability tracking, and abandoned plugin monitoring built around a safer WordPress ecosystem.

Meet Debug 360 Latest CVEs
!
Find Risks Early

Identify vulnerabilities, misconfigurations, and abandoned plugins before they become larger problems.

✓
Keep Sites Safer

Tools and research for site owners, developers, and agencies.

▥
A Healthier WordPress Ecosystem

More transparency, better tools, and less abandoned code.

Debug 360 by BlogSafe
Free plugin

Your debug.log is a public file. Debug 360 fixes that.

Debug 360 isn't a log reader. Its own PHP error handler and shutdown handler send errors straight into your WordPress database instead of a file anyone can download, and you read them in a fast, clear log in your admin.

  • Its own error and shutdown handlers catch errors as they happen, fatal ones included
  • Ignore the noise you can’t fix
  • Email alerts when something breaks
Get Debug 360 free Learn more

Debug 360 Pro adds grouped errors, stack traces and Slack, Teams, Discord & Google Chat alerts for $49.00 USD, with a 30-day money-back guarantee. See Pro

The Debug 360 log: PHP errors with their time, colour-coded, beside the debugging switches

Live vulnerability data

Latest WordPress CVEs

22,693 vulnerability records currently indexed.

View all CVEs
CVE-2026-126537 November 11, 2026
The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NF_FU_Fields_Upload::process()… Full details
CRITICAL 9.1
CVE-2026-123481 November 11, 2026
Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through… Full details
MEDIUM 4.3
CVE-2026-119615 November 11, 2026
The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.3. This is due to the process_reset() function being registered on admin_init with no capability check, a… Full details
HIGH 8.8
CVE-2026-109619 October 21, 2026
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer… Full details
CRITICAL 9.2
CVE-2026-109618 October 21, 2026
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized… Full details
CRITICAL 9.2
CVE-2026-92842 September 25, 2026
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL… Full details
MEDIUM 5.9

Homeless & Abandoned Plugins

Track unmaintained WordPress plugins, evidence of abandonment, known risks, alternatives, and future rescue work.

Browse Database