Monitoring Dictionary
CVE
Definition
A CVE is a public identifier for a known cybersecurity vulnerability tracked in shared databases.
Also called: Common Vulnerabilities and Exposures, CVE ID
Why it matters for WordPress
When a plugin hole goes public, it usually gets a CVE ID (and sometimes several related IDs). Scanners, hosts, and news posts use that ID so everyone means the same bug. Your job is not to memorize CVSS charts. It is to see whether your installed version is affected and whether a fixed release exists.
How it shows up in practice
- Advisory titles like “CVE-2026-##### in Plugin Name ≤ x.y.z”
- Vulnerability scanners listing the ID next to severity and fixed version
- Exploit posts that appear within hours of disclosure
- Changelog lines that quietly say “security fix” without the CVE in the UI
What to do
- Match the affected versions to what you actually run.
- Update to the fixed release when it exists; remove abandonware if it will never ship a fix.
- If you must delay, mitigate (disable the plugin, restrict access, tighten the WAF) and set a deadline.
- After patching, confirm the version and watch logs for probe traffic.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Vulnerability A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
- Plugin supply chain Plugin supply-chain risk is when trusted plugin code or updates become a path for attackers.
- Remote code execution Remote code execution is a vulnerability that lets an attacker run attacker-controlled code on the server.
- Security audit A security audit is a structured review of a site’s risks, misconfigurations, and recommended fixes.