Onboarding many sites
How agencies and teams connect many WordPress sites to PowerSEC Central, one site at a time, without copying keys by hand.
Incident → resolved — the full triage flow
Walk through a PowerSEC incident from first alert to resolved.
Restore dry-run checks before recovery
Before anything on your site is modified, every restore runs its own safety checks at restore time: - The backup artifacts must be present (missing cloud copies are downloaded first) - Each required artifact is checked against its stored SHA-256 checksum - A safety checkpoint (a…
Restore confidence states and chain health
Each restore point can carry one of five readiness states: - Healthy: Central's records and checksum metadata look complete for this restore point. - Legacy format: informational only — the backup uses an older format without manifest integrity metadata. Restore-time safety…
Backup limits by plan: storage and restore points
Cloud storage, restore points and the largest single backup for each plan, and what happens when a limit is reached.
Bring Your Own Storage (BYOS): add your own cloud bucket
Bring Your Own Storage (BYOS) lets you mirror every PowerSEC cloud backup into a storage bucket you own and control — on top of the PowerSEC-managed copy. This adds an independent, off-site copy in an account you control, so a problem with one copy needn't affect the other. Who…
CVE-2026-105077: Cross-site scripting in Ad Inserter
An attacker can inject malicious code into a website running the Ad Inserter plugin, which stores the code due to improper input handling. When a user visits… Affected component: Ad Inserter – Ad Manager & AdSense Ads (plugin) Fixed in: 2.8.20 PowerSEC coverage: PowerSEC detects…
CVE-2026-120538 in Easy Digital Downloads
An attacker can take over an administrator's account on a WordPress site running the Easy Digital Downloads plugin by exploiting a flaw in how the plugin… Affected component: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy (plugin) Fixed in: 3.7.3…
CVE-2026-103898
An authentication bypass vulnerability in the Wp Social Login and Register Social Counter plugin allows unauthenticated attackers to gain full access to any… Affected component: Wp Social Login and Register Social Counter (plugin) Fixed in: 3.2.3 PowerSEC coverage: PowerSEC…
CVE-2026-109997: Cross-site scripting in Ninja Forms
Unauthenticated attackers can inject arbitrary web scripts into pages via the 'formData.extra' parameter in Ninja Forms, which execute when a user accesses an… Affected component: Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder (plugin)…
CVE-2026-89270: Access control flaw in Popup Builder
An authorization bypass vulnerability in the Popup Builder plugin allows unauthenticated attackers to trash all published popups on a WordPress site. Affected component: Popup Builder – Create highly converting, mobile friendly marketing popups. (plugin) Fixed in: 4.4.6 PowerSEC…
CVE-2026-111254: Cross-site scripting in W3 Total Cache
Attackers can inject malicious web scripts into pages of WordPress sites using the W3 Total Cache plugin, which then execute when a user accesses an injected… Affected component: W3 Total Cache (plugin) Fixed in: 2.11.0 PowerSEC coverage: PowerSEC detects the affected versions…
CVE-2026-107750
Unauthenticated attackers can inject malicious scripts into customer order fields in the PDF Invoices & Packing Slips for WooCommerce plugin. Affected component: PDF Invoices & Packing Slips for WooCommerce (plugin) Fixed in: 5.16.5 PowerSEC coverage: PowerSEC detects the…
CVE-2026-76010
An authenticated attacker with custom-level access can achieve remote code execution in the NextGEN Gallery plugin for WordPress. This is due to unrestricted… Affected component: Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery (plugin) Fixed in: 4.5.0 PowerSEC…
CVE-2026-110732: Access control flaw in AI Engine
Unauthenticated attackers can register a malicious OAuth client with the AI Engine plugin due to a missing authorization check. This allows them to obtain… Affected component: AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini (plugin) Fixed in:…
CVE-2026-112311 in Advanced Custom Fields: Extended
An arbitrary file deletion vulnerability in the Advanced Custom Fields: Extended plugin for WordPress allows unauthenticated attackers to delete arbitrary… Affected component: Advanced Custom Fields: Extended (plugin) Fixed in: 0.9.2.8 PowerSEC coverage: PowerSEC detects the…
CVE-2026-94267
Unauthenticated attackers can execute code on the server by exploiting a vulnerability in the Advanced Custom Fields: Extended WordPress plugin. Affected component: Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO (plugin) Fixed in: 0.9.2.8 (Advanced…
CVE-2026-1928 in Rank Math SEO
Authenticated attackers with Contributor-level access can exploit a PHP Object Injection vulnerability in the Rank Math SEO plugin by sending crafted data to… Affected component: Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (plugin) Fixed in: 1.0.277 PowerSEC coverage:…
CVE-2026-75891 in Kirki
Authenticated attackers can exploit a PHP Object Injection vulnerability in the Kirki plugin for WordPress to overwrite an administrator's password and gain… Affected component: Kirki – Freeform Page Builder, Website Builder & Customizer (plugin) Fixed in: 6.3.0 PowerSEC…
CVE-2026-107436 in Strong Testimonials
Authenticated attackers with subscriber-level access can inject a PHP Object into the Strong Testimonials plugin due to deserialization of untrusted input. Affected component: Strong Testimonials (plugin) Fixed in: 3.3.13 PowerSEC coverage: PowerSEC detects the affected versions…
CVE-2026-87902 in WordPress
An unauthenticated path traversal vulnerability in WordPress Core's page-template resolution allows attackers to include arbitrary local PHP files. Affected component: WordPress (core) Fixed in: 4.7.37, 4.8.32, 4.9.33, 5.0.29, 5.1.26, 5.2.28, 5.3.25, 5.4.23, 5.5.22, 5.6.21,…
CVE-2026-60137: SQL injection in WordPress
An unauthenticated SQL Injection vulnerability in WordPress Core allows attackers to extract sensitive database information by manipulating the authornotin… Affected component: WordPress (core) Fixed in: 6.8.6, 6.9.5, 7.0.2 Known exploited: this CVE is listed in the CISA Known…
CVE-2026-101301: Access control flaw in WPCode
An unauthenticated attacker can disable automatically inserted code snippets for their own requests by bypassing the login page check in the WPCode plugin. Affected component: WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager (plugin) Fixed in:…
CVE-2026-109936: Cross-site scripting in Otter Blocks
An unauthenticated attacker can inject malicious web scripts into pages using the Otter Blocks plugin due to insufficient input sanitization and output… Affected component: Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE (plugin) Fixed in: 3.2.8 PowerSEC…
CVE-2026-113499: Cross-site scripting in LiteSpeed Cache
An unauthenticated attacker can inject malicious web scripts into pages of a WordPress site running the LiteSpeed Cache plugin. These scripts execute in the… Affected component: LiteSpeed Cache (plugin) Fixed in: 7.9.2 PowerSEC coverage: PowerSEC detects the affected versions on…
CVE-2026-97328: Cross-site scripting in WebP Express
Unauthenticated attackers can inject malicious scripts into pages via the WebP Express plugin's HTML parser when a non-default image delivery mode is active. Affected component: WebP Express (plugin) Fixed in: 0.25.16 PowerSEC coverage: PowerSEC detects the affected versions on…
CVE-2026-110899: Cross-site scripting in Ninja Forms
An unauthenticated attacker can inject malicious web scripts into pages generated by the Ninja Forms plugin for WordPress, which are then stored and executed… Affected component: Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder (plugin)…
WordPress care plans: what we do and how to ask for one
Our team can maintain your WordPress site for you: updates, security monitoring, off-site backups, uptime checks and a monthly report.
CVE-2026-107746 in FunnelKit
An attacker can exploit this vulnerability by sending a specially crafted request to a vulnerable WordPress site running the FunnelKit plugin. Affected component: FunnelKit – Funnel Builder Plugin for WooCommerce Checkout (plugin) Fixed in: 3.17.0 PowerSEC coverage: PowerSEC…
CVE-2026-84750 in Ultra Addons for Contact Form 7
Ultra Addons for Contact Form 7 3.2.4 to 3.5.50 lets unauthenticated visitors upload arbitrary files through a form field. Update to 3.5.51 or later. Affected component: Ultra Addons for Contact Form 7 (plugin) Fixed in: 3.5.51 PowerSEC coverage: PowerSEC detects the affected…
CVE-2026-82901 in Ultra Addons for Contact Form 7
Ultra Addons for Contact Form 7 up to 3.5.50 lets unauthenticated visitors upload arbitrary files via a signature field. Update to 3.5.51 or later. Affected component: Ultra Addons for Contact Form 7 (plugin) Fixed in: 3.5.51 PowerSEC coverage: PowerSEC detects the affected…
CVE-2026-63030 in WordPress
WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 have a remote code execution flaw in the REST API batch route that is being exploited. Update to 6.9.5 or 7.0.2. Affected component: WordPress (core) Fixed in: 6.9.5, 7.0.2 Known exploited: this CVE is listed in the CISA Known…
CVE-2026-19859 in JetFormBuilder
JetFormBuilder before 3.6.5.2 lets unauthenticated visitors run arbitrary shortcodes through its 'status' parameter. Update to version 3.6.5.2 or later. Affected component: JetFormBuilder — Dynamic Blocks Form Builder (plugin) Fixed in: 3.6.5.2 PowerSEC coverage: PowerSEC…
CVE-2020-25213 in File Manager
WP File Manager 6.8 and earlier lets unauthenticated attackers upload and run PHP files. It has been exploited in the wild; update to 6.9 or later now. Affected component: File Manager (plugin) Fixed in: 6.9 Known exploited: this CVE is listed in the CISA Known Exploited…
CVE-2020-11738 in Duplicator and Duplicator Pro
Duplicator before 1.3.28 and Duplicator Pro before 3.8.7.1 let unauthenticated attackers read any file on the server. It is being exploited; update now. Affected component: Duplicator Pro and Duplicator (plugin) Fixed in: 3.8.7.1 (Duplicator Pro), 1.3.28 (Duplicator) Known…
Allow PowerSEC through Cloudflare or a firewall
If Cloudflare or a firewall challenges PowerSEC's requests, actions to your site can be delayed or fail. Here is how to allow them.
Behavioral WAF: learning, monitor, and block modes
PowerSEC's Behavioral WAF is an optional signature layer on top of the core firewall. It is off by default and has three modes so you can turn it on without breaking your site.
Backup reliability on large or memory-constrained sites
PowerSEC backups are designed to run in passes so large sites can complete without relying on one long request. Reliability on constrained hosting Recent improvements reduce the chance of memory exhaustion on shared or memory-limited hosting. Large backup file lists are stored…
Whole-site malware scanning and webshell detection
PowerSEC's malware scanner reviews PHP-like executable files across your entire WordPress installation, including writable and non-standard directories — uploads, cache, backup folders, and security-plugin log folders — where attackers often hide malicious files. Active…
AI Advisory: second-opinion malware reviews
AI Advisory is a second-opinion review for selected malware findings, on Pro Protection, Pro + Backup Plus and Agency.
Does PowerSEC scan for malware automatically?
Yes. As of plugin v1.4.107 PowerSEC runs its full malware scanner automatically in the background on a schedule, in addition to on-demand scans. Available on every plan.
Database Health: the safe cleanup workflow
PowerSEC's Database Health screen (in the plugin under Database → Database Health, and on the Central dashboard under your site's Database Health panel) shows a health score, a per-table breakdown, and a set of one-click cleanup actions. This guide explains what those numbers…
Reading AI Advisory verdicts and incident summaries
How to read AI Advisory results and AI incident summaries.
How PowerSEC's malware scanner stays safe
PowerSEC's scanner detects malware by static pattern matching and never runs the code it scans.
Why some vulnerabilities are flagged "fix first"
PowerSEC flags vulnerabilities that are confirmed exploited in the wild (CISA KEV) and sorts them to the top so you patch what attackers are actually using first.
Performance impact of PowerSEC
What PowerSEC runs on your server, when it runs, and how to reduce its footprint on a busy or small host.
False positives in malware scans
Sometimes the scanner flags a legitimate file. Here is how to tell, and what to do about it.
Site not syncing — what to check
If a site shows an old "last sync" time in the dashboard, work through this checklist.
Plugin installation troubleshooting
If the PowerSEC plugin won't install, activate, or reach PowerSEC Central, this guide walks through common causes.
Refund policy
Our refund policy in plain language: the Pro Protection trial, refund windows, and how to ask for a refund.