Short answer: three free, public databases tell you which security holes actually matter — and you don’t need a security team to read them. Use CISA KEV for what’s being exploited worldwide right now, Patchstack and WPScan for your WordPress plugins and themes, and the CVE / NVD feed for the rest of your stack. Below: what each one is, and how to use it in ten minutes a month.
We run managed hosting and watch these feeds for client sites every day, so this is the practical version — linked to the sources themselves, not to blog re-tellings.
Why a known vulnerability is the dangerous kind
A “known vulnerability” sounds harmless — it’s documented, and there’s usually a fix. That’s exactly why it’s dangerous: the fix is public, and so, often, is working exploit code. Attackers automate against it at scale. When the critical React2Shell flaw (CVE-2025-55182, CVSS 10.0 — the maximum on the 0–10 severity scale) went public in December 2025, attackers were exploiting it within hours — Cloudflare logged over 582 million exploit attempts in the first week. “We’ll update next month” is the gap they live in.
1. CISA KEV — what’s actually being exploited right now
What it is: the Known Exploited Vulnerabilities Catalog, kept by the US cyber agency CISA. A vulnerability only makes the list when three things are true: it has a CVE ID, there’s a clear fix, and there’s reliable evidence it’s being used in real-world attacks.
Why it’s useful: thousands of CVEs are published every year and most are never weaponised. KEV is the short list of the ones that are. US federal agencies are legally required to fix everything on it by a deadline — CISA recommends every organisation treat it the same way.
How to use it (free): browse it on cisa.gov, or download the whole catalog as CSV or JSON, and search for the software you run.
Honest caveat: KEV leans toward enterprise gear — VPNs, firewalls, mail servers, Microsoft products. If your site is a WordPress brochure or shop, most of your real risk won’t appear here. That’s what the next two cover.
2. Patchstack and WPScan — for WordPress, where most SMB risk lives
On a WordPress site, the holes that get you are almost always in plugins and themes, not the core. Two free databases track exactly that:
- Patchstack — a free, hand-curated database of WordPress plugin, theme and core vulnerabilities. Search a plugin name; see its known issues and the version that fixes them.
- WPScan — a continuously updated WordPress vulnerability database (owned by Automattic). It offers a free API tier for non-commercial use and a command-line scanner. The easiest route for a non-technical owner is Jetpack Protect, a free plugin that uses WPScan data to flag vulnerable plugins on your own site.
Practical move: open your plugin list and check the ones you actually run. The plugin you installed two years ago and forgot is the classic way in.
3. CVE / NVD — for everything else in your stack
For the parts that aren’t WordPress — PHP, a JavaScript framework, libraries, the server itself — the base layer is the CVE program and the US National Vulnerability Database. Both are free and public. You won’t read these by hand every day; tools and hosts watch them for you. But that’s where the authoritative record lives.
How to use all this without an IT team
- Once a month, list what your site actually runs: WordPress version, active plugins and themes, PHP version.
- Check the WordPress pieces in Patchstack or via Jetpack Protect; glance at KEV for any enterprise software you depend on.
- If something you run is listed — update it. If there’s no fix yet, disable or replace it until there is.
- Test the update on a copy first, so the fix doesn’t break your live site.
The honest limit of any list
A database tells you what’s vulnerable. It doesn’t patch anything, and it won’t wake you when a new hole drops at 2am on a Sunday. Someone has to watch the feeds and apply fixes in time — that’s the real work, and it’s most of the reason managed hosting exists.
That’s the part we do: on our managed hosting we track these feeds for your exact stack on every plan and close holes — tested on a copy of your site first, so a patch never breaks the live one. If you’d rather not become your own security analyst, that’s the offer.