blogsafe.org My Downloads

BlogSafe.org

WordPress Security Tools, Research, and Recovery

Diagnostics, vulnerability tracking, and abandoned plugin monitoring built around a safer WordPress ecosystem.

Meet Debug 360 Latest CVEs
!
Find Risks Early

Identify vulnerabilities, misconfigurations, and abandoned plugins before they become larger problems.

✓
Keep Sites Safer

Tools and research for site owners, developers, and agencies.

▥
A Healthier WordPress Ecosystem

More transparency, better tools, and less abandoned code.

Debug 360 by BlogSafe
Free plugin

Your debug.log is a public file. Debug 360 fixes that.

Debug 360 isn't a log reader. Its own PHP error handler and shutdown handler send errors straight into your WordPress database instead of a file anyone can download, and you read them in a fast, clear log in your admin.

  • Its own error and shutdown handlers catch errors as they happen, fatal ones included
  • Ignore the noise you can’t fix
  • Email alerts when something breaks
Get Debug 360 free Learn more

Debug 360 Pro adds grouped errors, stack traces and Slack, Teams, Discord & Google Chat alerts for $49.00 USD, with a 30-day money-back guarantee. See Pro

The Debug 360 log: PHP errors with their time, colour-coded, beside the debugging switches

Live vulnerability data

Latest WordPress CVEs

22,604 vulnerability records currently indexed.

View all CVEs
CVE-2026-123460 November 9, 2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2. Full details
HIGH 7.1
CVE-2026-115252 November 9, 2026
The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that… Full details
CRITICAL 10
CVE-2026-106466 November 9, 2026
The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user changes or resets their password or removes a connected device, allowing an attacker who obtained a refresh… Full details
HIGH 7.5
CVE-2026-109619 October 21, 2026
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer… Full details
CRITICAL 9.2
CVE-2026-109618 October 21, 2026
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized… Full details
CRITICAL 9.2
CVE-2026-92842 September 25, 2026
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL… Full details
MEDIUM 5.9

Homeless & Abandoned Plugins

Track unmaintained WordPress plugins, evidence of abandonment, known risks, alternatives, and future rescue work.

Browse Database