blogsafe.org My Downloads

BlogSafe.org

WordPress Security Tools, Research, and Recovery

Diagnostics, vulnerability tracking, and abandoned plugin monitoring built around a safer WordPress ecosystem.

Meet Debug 360 Latest CVEs
!
Find Risks Early

Identify vulnerabilities, misconfigurations, and abandoned plugins before they become larger problems.

✓
Keep Sites Safer

Tools and research for site owners, developers, and agencies.

▥
A Healthier WordPress Ecosystem

More transparency, better tools, and less abandoned code.

Debug 360 by BlogSafe
Free plugin

Your debug.log is a public file. Debug 360 fixes that.

Debug 360 isn't a log reader. Its own PHP error handler and shutdown handler send errors straight into your WordPress database instead of a file anyone can download, and you read them in a fast, clear log in your admin.

  • Its own error and shutdown handlers catch errors as they happen, fatal ones included
  • Ignore the noise you can’t fix
  • Email alerts when something breaks
Get Debug 360 free Learn more

Debug 360 Pro adds grouped errors, stack traces and Slack, Teams, Discord & Google Chat alerts for $49.00 USD, with a 30-day money-back guarantee. See Pro

The Debug 360 log: PHP errors with their time, colour-coded, beside the debugging switches

Live vulnerability data

Latest WordPress CVEs

22,619 vulnerability records currently indexed.

View all CVEs
CVE-2026-89324 November 10, 2026
The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.18. The vulnerability exists because a missing-quotes coding error in the defined() call for SECURE_AUTH_SALT… Full details
CRITICAL 9.8
CVE-2026-105150 November 10, 2026
The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'text_no_products' parameter in all versions up to, and including, 3.4.5 due to insufficient input sanitization and… Full details
MEDIUM 6.1
CVE-2026-115483 November 10, 2026
The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attach_entry_files() function. This is due to the function attaching any entry field… Full details
HIGH 7.5
CVE-2026-109619 October 21, 2026
PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer… Full details
CRITICAL 9.2
CVE-2026-109618 October 21, 2026
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized… Full details
CRITICAL 9.2
CVE-2026-92842 September 25, 2026
The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL… Full details
MEDIUM 5.9

Homeless & Abandoned Plugins

Track unmaintained WordPress plugins, evidence of abandonment, known risks, alternatives, and future rescue work.

Browse Database