Patchstack
@patchstackapp

Fastest vulnerability protection for WordPress websites! Official security partner for the leading web hosting companies, agencies, and plugin devs.

patchstack.com
Joined May 2016
Our "State of WordPress Security 2026" report is now live! 💥 This year we took a step back to look at the impact of vulnerabilities rather than the overall numbers. We also teamed up with Monarx to explore how malware campaigns and techniques evolved during 2025. **Key learnings:** ⚠️ More high severity vulnerabilities were found in 2025 than in the two previous years *combined* ⚡ Median time from discovery to mass exploitation for severe vulnerabilities is just 5 hours ❌ 46% of vulnerabilities were not fixed by developer by the time of public disclosure 💸 76% of vulnerabilities found in premium components were exploitable 🥷 Increased usage of uploader scripts suggests attackers are adopting more complex strategies Read the whitepaper for the full insights ( 🔗 link in comments!)
2
3
760
If you’re at @MSPglobalevent and looking to protect your customers websites against vulnerabilities that traditional WAFs fail to mitigate - meet us tomorrow by finding the booth that’s not blue and let’s have a chat! 🫡 #mspglobal
1
1
310
Replying to @JGamblin

ALT Side Eye Suspicious GIF
1
27
Replying to @RocketDotNet @wearehostingcom

ALT Work Chris Farley GIF
2
93
Our amazing @iamrashminagpal was invited to give a talk about Quantum AI at CERN. 🪐
3
1
16
1,835
Secure your WordPress plugins with the Patchstack AI code review tool! Available as part of the new Security suite. More information in 🧵
1
3
11
1,011
67.4% of web hosting companies have said WordPress vulnerabilities are their biggest security challenge. Not with Patchstack! 😉
2
1
8
1,152
Update: The funding was restored and CVE program will continue to operate as normal.
2
124
Today we surpassed 10k ( 😱) confirmed vulnerability CVE ID's, most of them in WordPress ecosystem. For a deeper dive into what such numbers mean for WordPress and its safety, check our latest annual report (🔗in thread):
1
2
11
391
Full webinar (not gated!) piped.video/watch?v=8XcgyQ_M…
107
Often running an agency feels like you're barely keeping your head above water 🌊 But what do enterprise agencies do different to get ahead of that? Tune in to our webinar ft. @karimmarucchi for a blueprint on enterprise success: 🔗 Video link in thread:
1
1
106
🚨 Security alert! Critical issue found in WP Ghost plugin. Expected to become mass exploited. Patchstack users with virtual patching protected 🛡️ Details & analysis in thread:
1
6
7
449
Cloudfest Day 2 is a wrap! Come by booth H21 to talk security 🛡️ - we'll be here all week! #cloudfest #wordpress
3
10
1,020
Going to Cloudfest? Catch our big State of WordPress Security address on Wednesday at 12:15! @OliverSild will share the biggest challenges WP is facing, plus most important security stats from last year👀
1
4
12
769
💻 #CloudFest Hackathon day 2 is in full swing and the team, lead by @pharar and John Blackbourn, is really racking their brains. 🧠 ⚡️ Curious to see the results? Come see the final presentations tomorrow at 3:55 PM at the Ring Stage in Europa Park. 👀 #CFHack #CFHack2025 #SBOM #TeamSBOMINATOR #WordPress #CyberSecurity #SupplyChain
6
17
1,582
Patchstack is working with @crowdfavorite and @Pagely to provide enterprise grade WordPress security to some of the largest media companies in the world.
2
1
8
1,257
💥Our annual WordPress security whitepaper is live! Covering the biggest security challenges @WordPress is facing in 2025, and of course last year’s stats, including: ⚠️7,966 new vulnerabilities found ⚠️33% of vulnerable plugins not fixed in time for disclosure ⚠️1,600+ plugins removed for unfixed vulns And more! 🔗in thread:
5
5
21
3,346
An unauthenticated Arbitrary File Upload vulnerability was found in Chaty Pro plugin 🛡️ This allows the attacker to upload a malicious file and take over the site 🚫 The issue was fixed in version 3.3.4 ✅ With Patchstack protection activated, you're already protected 🛡️
1
1
308
Over 500 WordPress related security vulnerabilities have been reported to Patchstack in February alone - and the reports are still coming in. This is the most active February we’ve had in Patchstack bounty program history! 👏
1
1
5
367
Crazy numbers reported by @ComputerWeekly - but there were 7,966 new vulnerabilities in WordPress ecosystem alone in 2024 👀 ❗Also with Cyber Resilience Act coming, plugin devs will be under pressure to deal with these volumes. This is why we created our free security program for devs🧵:
1
1
6
609
⚡WEATHER ALERT! We interrupt your regularly scheduled scrolling to let you know Patchstack will be at @cloudfest 17.-20.03! Seek shelter from vulnerable software at booth H21 ☂️ That is all. #cloudfest #cloudfest2025
3
4
862
🤫We'll be publishing our State of WordPress Security whitepaper next month - sign up to be notified when it's live! (Link in bio)
1
2
13
2,701
#WCAsia is just around the corner - and we'll be hosting an exciting Capture The Flag event 🚩 Don't miss out—mark your calendars for 20-22 February 📆 Best hackers get some amazing prizes 🥷 Link in 🧵
1
2
11
2,492
🚨 Rare Case of Privilege Escalation in Admin and Site Enhancements Plugin. It occurs due to broken logic on the “View Admin as Role”🤔 Update it immediately to at least 7.6.3🔧 If you have Patchstack protection enabled, you are already automatically protected🛡️
1
3
164
🚨 High priority vuln fixed in the "Better Find and Replace" plugin - expected to become mass exploited! Update plugin immediately to at least 1.6.8 If you have Patchstack protection enabled, you are already automatically protected 🛡️
1
4
4
392
🚨 Critical Vulnerability Patched in GiveWP Plugin. Versions 3.19.3 and below suffer from an unauthenticated PHP Object Injection vuln. 💻 This was fixed in version 3.19.4, so update ASAP. 🛠️ As a paid Patchstack user you're protected from this vuln🛡️ Link in the comment ⬇️
2
3
7
3,034
Critical Vulnerabilities Found in Fancy Product Designer Plugin! 🚨 It suffers from Unauthenticated Arbitrary File Upload and SQL Injection vulns. ⛓️‍💥 No patch was released. 😔 As a paid Patchstack user you're protected from those vulns🛡️ Link in the comment ⬇️
1
2
1
1,663
Advisory Alert: Critical Vulnerabilities Fixed in WPLMS and VibeBP! 🚨 Please update to versions 1.9.9.5.3 and 1.9.9.7.7. ⬆️ You are also protected from this vulnerability if you are a paid Patchstack user. 🛡️ Link in the comment ⬇️
1
2
3
1,291
Imagine if your #WooCommerce store were hacked. It's a dreadful thought, we know, but it can happen. 😱 Don't panic, though. Lana has prepared a 10-step guide to help you restore your site. 💪 Link in the comment 👇
1
3
4
1,015
Our researcher, Edouard, shares fascinating insights about the most exploited WordPress threats in Q4. 🕵️‍♂️ He also provides in-depth examples of how virtual patches work to protect against vulnerabilities. 💻 Link in the comment 👇
1
2
2
708
🎅 revisited Patchstack HQ. He needs you to find more difficult vulns in #WordPress plugins and themes. 📅 When: 17-23 Dec 🛡️ What: SQLi, PHP Object Injection, Insecure Deserialization 📊 CVSS: 7.0+ 📈 Installs: 50+ 🎁 $4700 bounty pool Learn more at patchstack.com/bug-bounty/
1
33
12,351
We released an advisory about Multiple Critical Vulnerabilities Patched in the Woffice Theme. 🔒 If you use it, update it to version 5.4.15+. ⬆️ You're also protected from this vuln if you are a paid Patchstack user. 💪 Link in the comment 👇
1
2
8
880
🎅 visited Patchstack and has a quest for you to find vulns in #WordPress plugins and themes. 📅 When: 10-17 Dec 🛡️ What: XSS, CSRF, Arbitrary file download, privilege escalation, or sensitive data exposure 📊 CVSS: 6.4+ 📈 Installs: 50+ Learn more at patchstack.com/bug-bounty/
6
548
We released an advisory about an unauthenticated Privilege Escalation Vulnerability #vulnerability in Sweet Date Theme 🚨 If you use it, update it to version 3.8.0+ if possible ⬆️ You're also protected from this vuln if you are a paid Patchstack user 💪 Link in the comment 👇
1
3
6
817
Last chance to grab the best vulnerability management tool for #WordPress ! Deal closes at the end of the day  🫡🫡 Deal link in thread 🧵 #CyberMonday #cybersecurity
1
3
632
We just released an advisory about an authenticated RCE #vulnerability in Rank Math SEO plugin 💻 If you use this plugin, please update it to version 1.0.232 or later. 🔧 You're also protected from this vuln if you are a paid Patchstack user. 🔒 Link in the comment below 👇
1
4
7
1,265
Last chance to get our Black Friday deal! 📢 Get the fastest protection for #WordPress vulnerabilities & stop scrambling for security updates 🔗 Get the deal link in thread:
4
3
7
4,852
We just launched a Black Friday special #bounty event 🛒 📅 When: 26 Nov to 08 Dev 🛍️ What: WooCommerce and alternatives, payment gateways, and plugins extending eCommerce functionality 🔒 CVSS: 6.4+ 📈 Installs: 50+ active installs Link in the comment 👇
1
5
14
791
We have just released an advisory about the Unauthenticated Arbitrary File Read Vulnerability in the Jobify Theme. 🔒 Unfortunately, this vulnerability is still unpatched. 😞 However, all paid Patchstack users are protected from this vuln. ✅ Link in the comment below 👇
1
3
4
605
We are proud sponsors of #WordCamp #Wroclaw 🇵🇱💪 Make sure to say "cześć" to @palmiak_fp. Catch his talk on security this Saturday, and snag some cool Patchstack swag while you're at it! 🛡️🎤 Do zobaczenia 🙂
1
1
7
624
We just published an advisory about the critical vulnerability in the Really Simple Security plugin found by @LanaCodes. The plugin suffers from an unauthenticated account takeover vuln allowing anyone to log in to any account only by knowing the user ID. Link in the comment 👇
1
2
6
570
Our latest newsletter is live! 🚀 Inside, you'll find: ❓ What causes Arbitrary File Upload vulnerabilities? 🗳️ Vote for Patchstack as the "Best Security Plugin" 📚 WordPress salts 101 Read it here: preview.mailerlite.io/previe…
1
2
4
446
If you are using LiteSpeed Cache you should update it ASAP to version 6.5.2 🚨 TaiYou, one of our researchers, found a Privilege Escalation vulnerability. Learn what happened and how it got fixed in the article below 👇
1
2
2
525
This week, @CVEnew turns 25 🏆 The Common Vulnerabilities and Exposures Program is the backbone of global efforts to make software safer to use for all. So let's reflect a bit: 🧵
1
2
4
1,663
We were at "just" 600 new validated vulnerabilities for October last week, Patchstack Alliance cleaning up house rn 💪 #BugBounty
2
1
7
580
We found two critical vulnerabilities in the Ultimate Membership Pro plugin❗ After you update it to the latest version (ASAP), read the article to learn what happened and how it was fixed. Link to the article in the comment below 👇
1
3
6
514
And we are ringing in our security talk at #WCGdynia 🔔 Sound on, if you dare 🙈 Feat. our very own @palmiak_fp
1
6
617
We're at #WCGdynia 🐟 Come and grab some amazing swag 😎
2
1
28
5,765
Our AI/ML engineer Rashmi was invited to give a talk at @PyTorch about crafting unbiased, transparent and explainable large language models. Check it out 👇🏼 piped.video/vGHb4jO2_Ks?feature…
3
733
We just published another #security advisory regarding LiteSpeed Cache. 🔒 This time it's about Stored XSS. Learn what happened and how it was fixed. ℹ️ You should do it right now if you haven't updated this plugin yet. 🚨 Link in the comments 👇🔗
1
4
6
632
If you are using TI WooCommerce Wishlist Plugin, you should definitely check the article below. Why? Because this plugin still contains an SQL injection vulnerability. 😬 Luckily, if you are using Patchstack there is a vPatch that can help you. ✅ Article in the comments 👇
1
1
4
376
Learn about the Houzez Theme and Login Register plugin Privilege Escalation vulnerability. 🔒 It allowed everyone to reset any user's password or change any user's email. Developers have already released the fix, so if you use 3.3.0, you are safe. ✅ Link in the comment 👇
1
1
1
382
Day 2 of #WCUS2024 let's gooo! Drop by our booth to get all your WordPress security questions answered 🤓 Also YES we still have those cool socks. A lot of socks. Come get socks!
1
4
580
We'll be at #WCUS2024 today - drop by our booth to say hi & talk security! #WordPress #wordcampus
1
5
1,226
Stay Secure: How Patchstack’s vPatches protect your WordPress site against the latest vulnerabilities patchstack.com/articles/stay…
103
Hey #WCUS - drop by our chat with @miriamschwab at 2:30PM & learn how bug bounty programs can help you build more secure plugins! #WordPress
1
1
6
1,034
Live today at #WCUS - how Elementor leveraged our Bug Bounty program to build faster processes for handling security reports. Talk at 2:30 PM (Timbers) - featuring @OliverSild & @miriamschwab
1
3
526
We'll be at #WCUS this week! Drop by our booth to learn about: 🛡️ how we protect WordPress sites against vulnerabilities 🧩 our free vuln disclosure platform for plugin devs 🐛 Patchstack Alliance Bug Bounty Program 🥷 a special WordCamp CTF challenge Info in comments
1
1
5
1,378
Get ready for an exciting #WCUS! We're hosting a CTF event from September 16-21 with 9 awesome challenges. And if you're attending #WCUS, drop by our booth. Sign up now at ctf.patchstack.com/
1
2
300
To celebrate the #WCUS, we're doing a CTF event on 16-21 September. 9 cool challenges await you. Also, if you are at #WCUS - don't forget to visit our booth. Register at ctf.patchstack.com/
4
6
1,001
We just launched the new VDP platform! 🚀 It helps vendors: 🚀 Automate CRA compliance 🔒 Streamline security reports 🐞 Validate vulnerabilities 📢 Coordinate disclosure Check out the full announcement in the comment below 👇
1
7
9
846
Last month @johnbillion won our Bug Bounty. What's amazing about it is that he just sent one report that brought him a $16400 bounty. Cool, right? Learn how he did it, what he would change in #WordPress security, and how fluffy his cats are. Link in the comment below 👇
1
1
6
594
Hello #pyconestonia - please enjoy this nature documentary of our designer Andreas in his natural habitat. P.S. we are hiring for several developer roles - if you too would like to work alongside Andreas, see our careers link in the comments.
2
1
5
693
Critical Account Takeover Vulnerability Patched in LiteSpeed Cache Plugin patchstack.com/articles/crit… 🔗
100
Critical #vulnerability alert 🚨 Another critical vulnerability was found in LiteSpeed Cache. This one can lead to an Account Takeover. Check the security advisory by @yeraisci_ to learn what happened and how the LiteSpeed Cache team fixed it. Link in the comment below 👇
1
1
2
244
Critical Account Takeover Vulnerability Patched in LiteSpeed Cache Plugin patchstack.com/articles/crit… 🔗
44
Heading to @PyConEstonia on September 5-6? Don't miss @ibadrehmankhan's must-hear talk, "Detecting Vulnerabilities - Static Code Analyzers vs LLMs." 🛡️ Swing by and say "hi" to the Patchstack team, too! 👋 No ticket yet? Use the P4TCHSTACK code. 🎟️
2
4
586
Replying to @patchstackapp @scottbuscemi
WordPress (and the entire ecosystem) has to adapt.
36
We've just published an article by @yeraisci_ about the Critical Privilege Escalation in LiteSpeed Cache Plugin Affecting 5+ Million Sites A thread 🧵
4
8
1,278
Special Event Alert 🚀 🗓️ August 1 - 31, 2024 ❓ Target: SQLi vulnerabilities (severity 8.0+) in popular apps (10K+ installs, updated within 3 years). 🏆 Prizes: AXP x2 + cash ($75 for CVSS 8.x, $100 for CVSS 9.x, $150 for CVSS 10). More info below 👇
1
1
4
182
🚨 Major upgrade alert for Bug Bounty! 🚨 🎉 Monthly prizes are now doubled 👥 20 winners each month, up from 15 💰 Enhanced Zeroday program rewards 🔝 Introducing a new tier for plugins with over 5000 installs Get the full scoop in the comments 👇
1
1
3
464
What is PCI-DSS 4.0, and why is it crucial for every #ecommerce website owner? 🛡️ Discover all the details in our article, covering the "hows" and "whys." Link in the comment 👇
1
1
171
Our latest newsletter is live! 🚀 Inside, you'll find: 🔍 More insights on the Incident Response Plan 💳 PCI-DSS 4.0 compliance for eCommerce tips 📚 What is Patchstack Academy Read it here: preview.mailerlite.io/previe…
1
1
1
199
Your weekly #WordPress vulnerability report is here 👀 🐛 70 new vulns added to the database 🚨 6 with high severity ⚠️ 10 found in 100k+ install count plugins Read the scoop - link in the comment 👇
1
3
192
Our latest newsletter is live! 🚀 Inside, you'll find: 📚 More insights on the Incident Response Plan 💰 Major upgrade to the WordPress Bug Bounty 🔓 Reasons and methods behind WordPress site hacks Read it here: preview.mailerlite.io/emails…
1
176
Real Hackers Explain How and Why WordPress Sites Get Hacked patchstack.com/articles/real…
68
Have you ever wondered why and how #WordPress sites get hacked? If so, this article is for you. Real hackers share their experience and explain how to protect your website from getting hacked. Check the article link in the comments 👇
1
1
2
254
Special Event Time 🚀 🗓️ When? From 1 to 31 August 2024 ❓ What? SQLi vulns with severity 8.0+, with 10K+ installs, updated during the last 3 years. 🏆 Rewards? AXP x2 + bounty per vuln if CVSS 8.x – $75, CVSS 9.X – $100, CVSS 10 – $150. Check the comment for more details 👇
1
5
10
435
🚨 Biggest Bug Bounty upgrade is here! 🚨 🎉 Monthly competition bounties will be twice as big 👥 20 people will get the awards instead of 15 💰 Bigger Zeroday program bounties 🔝 New tier for 5000+ installs plugin in Zerodays bounties Check details in the comment 👇
1
5
523
Yesterday, our latest newsletter edition went live 🚀 Inside, you'll find: 📝 What is an Incident Response Plan 🔒 20k vulnerabilities added to the database Give it a read here: preview.mailerlite.io/previe…
1
2
5
263
Your weekly #WordPress vulnerability report is here 👀 🐛 78 new vulns added to the database 🚨 15 with high severity ⚠️ 14 found in 100k+ install count plugins Read the scoop - link in the comment 👇
1
119
Guess how many vulnerabilities Patchstack has published? That's right - 20000! 🎉 Huge thanks to all researchers making this possible. 🙌 PS. if you want to help us reach 30k quicker - join our bounty program. 💪
1
7
235
#security is like a cake 🍰 - it has layers. It's time to grab your fork! Together, we'll help you understand the critical areas you need to protect and how you can do it. Link in the comment below 👇
1
1
7
476
Yesterday, our latest newsletter edition went live. Inside, you'll find: ❓ Are auto-updates a big risk? ⚠️ Critical vulnerability in Backup and Staging Plugin 🎤 @pharar & @LanaRafaelaC at the #StellarSpark conference Give it a read here: preview.mailerlite.io/emails…
1
1
3
218
Your weekly #WordPress vulnerability report is here 👀 🐛 218 new vulns added to the database 🚨 13 with high severity ⚠️ 13 found in 100k+ install count plugins Read the scoop - link in the comment 👇
1
1
2
192
Don't miss @LanaRafaelaC speaking at #StellarSpark ✨ Learn what old-school WordPress blogs & current #SEO have in common. Sign up for our free event here: stellarwp.com/stellar-spark/
2
148
Don't miss @pharar speaking at #StellarSpark ✨ Discover if #WordPress is secure or not. Sign up for our free event here: stellarwp.com/stellar-spark/
1
5
10
563
Your weekly #WordPress vulnerability report is here 👀 🐛 213 new vulns added to the database 🚨 19 with high severity ⚠️ 15 found in 100k+ install count plugins Read the scoop - link in the comment 👇
1
3
5
396
Earlier this week, we released a new issue of our newsletter. This edition focuses on: 🔒 Two Factor Authentication 🐞 Polyfill vulnerability impact on #WordPress Check it out here: preview.mailerlite.io/emails…
1
1
189
This week's WordPress vulnerability news are here! 🐛 195 new vulns added 🚨 11 with high severity! ⚠️ 22 found in popular plugins (100k+ installs) Link in thread:
1
177
Our own @palmiak_fp will be a speaker at @developer_week in Nurnberg 🚀 If you're attandaing that amazing conference - don't forget to say hi and ask about some amazing coffee tips. #DWX24
1
2
306
Contributor+ Stored XSS via HTML API The set_attribute function will construct the $updated_attribute variable with URL value which is could lead to an XSS. FIX: The core team decided to apply a more strict escaping or sanitization to the vulnerable code.
1
1
2
59
Contributor+ Stored XSS via template-part The $attributes['tagName'] value will be constructed into $html_tag variable with an esc_attr function. This escaping process can still cause an XSS. FIX: new function filter_block_core_template_part_attributes was introduced.
1
1
1
65
Contributor+ Path Traversal (Win Only) Due to an incomplete check on the validate_file function, users can supply a Windows-based path traversal and read or include arbitrary files which could lead to an XSS. FIX: the Core team decided to use the wp_normalize_path function.
1
1
1
51
We've just published an article by @yeraisci_ about the WordPress Core 6.5.5 Security Update. A thread 🧵
1
3
8
482
Earlier this week, we released a new issue of our newsletter. This edition focuses on: 🔒 page builders security Check it out here: preview.mailerlite.io/emails…
1
124
Your weekly #WordPress vulnerability report is here 👀 🐛 174 new vulns added to database 🚨 24 with high severity ⚠️ 10 found in 100k+ install count plugins Read the scoop - link in the comment 👇
1
3
7
444
Load more