WPScan - WordPress Security

Our researchers found a Pre-Auth Object Injection vulnerability in the SEOPress plugin (300k+ active installs). It was fixed in the recent 7.9 update. Make sure to update now! #wordpress #security wpscan.com/blog/object-in…

Thank you WPScan'ers for your trust! We're sending holiday cheer to you and your family. ☃️

Our researchers found a Pre-Auth Stored XSS vulnerability in the WP Go Maps plugin (formerly known as WP Google Maps, 400k+ active installs). It was fixed in the recent 9.0.28 update. Make sure to update now! #wordpress #security wpscan.com/blog/stored-xs…

Our researchers found a Pre-Auth Stored XSS vulnerability in the Popup Builder plugin (200k+ active installs). It was fixed in the recent 4.2.3 update. Make sure to update now! #wordpress #security wpscan.com/blog/stored-xs…

Our researchers found a serious SQL Injection vulnerability in the WP Fastest Cache plugin. It was fixed in the recent 1.2.2 update. Make sure to update now! wpscan.com/blog/unauthent… #wordpress #security

URGENT: Active Hacking Campaign Targeting WordPress Plugin 'Royal Elementor Addons' (200,000+ active installs). Update to 1.3.79 ASAP! For more info: wpscan.com/blog/unauthent… #wordpress #security

Our researchers found a RCE gadget chain in WordPress Core. Fortunately, it was fixed on the recent 6.3.2 update. Here's how it worked: wpscan.com/blog/finding-a… #wordpress #security

Email Leak Oracle Vulnerability Addressed in WordPress 6.3.2 #wordpress #security wpscan.com/blog/email-lea…

URGENT: Active Hacking Campaign Targeting #WordPress Plugin 'Ultimate Member' (200,000+ active installs). We strongly recommend disabling this plugin immediately until a patch is released that fixes the vulnerability. For more info: blog.wpscan.com/hacking-campai…

Are you attending WordCamp Europe in Athens? We'd love to see you and talk security! Please come find the WPScan team at the Jetpack booth at WCEU. #WCEU #WordPress #security

WordPress VIP Integrates WPScan to Flag Potential Vulnerabilities with Major Sites Before They Go to Production blog.wpscan.com/wordpress-vip-…

Uncovering a PHAR Deserialization Vulnerability in WP Meta SEO and Escalating to RCE blog.wpscan.com/uncovering-a-p…

WP Engine’s Security Team Creates Custom Workflow with WPScan to Protect Clients blog.wpscan.com/wp-engines-sec…

What is a brute force attack? blog.wpscan.com/what-is-a-brut…

Thanks @HackingArticles for sharing the WPScan Cheat Sheet.

WordPress Black Box Testing Basics blog.wpscan.com/wordpress-blac…

Fake plugin affecting WordPress sites blog.wpscan.com/fake-plugin-af…

Protecting your WordPress website against SQL injection attacks blog.wpscan.com/protecting-you…