Website software advisories
The software behind a business website changes under it. Platforms publish security notices, add-ons are abandoned, and versions leave support on dates nobody in the business chose. This page lists the notices the Website Exposure Report is tested against, in plain English, with what the report would show for a site still running the affected version.
What this list is
Two kinds of notice appear here. A security notice is published by the maker of the software when a fault is found that an attacker can use; the entry says what the fault lets an attacker do and which versions close it. An end-of-support notice marks the date a version stopped receiving fixes; anything found after that date stays open on every site still running it.
Every entry links to the publisher’s own notice. We add nothing to what the publisher says, we name no business, and we publish no fix list. The free website health check tells you whether any of it applies to you.
How to read it
The State column shows what the Website Exposure Report would say for a site still running the affected version.
| State | Meaning |
|---|---|
| Current | The version in use still receives security updates. |
| Behind | A newer release exists. The version in use is behind on security updates. |
| No longer supported | The version in use has reached the end of its life and receives no security updates. |
Flagged notices
A red Flagged mark means a notice is recent and serious: the publisher rates it critical, it lets an attacker run code on the server without logging in, or it is already being used in live attacks. A flag is a reason to check today rather than this month. It is not a score, and it is removed when the notice ages.
| Published | Software | Severity | State | Fixed in | Source |
|---|---|---|---|---|---|
| Published | Software Node.js — the runtime under many modern websites and web apps Flagged · Remote code execution; a public proof of concept appeared on 22 October All supported lines before 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and older get no fix. A memory fault in the code that unpacks compressed web traffic lets an attacker run their own program on the server. Any site built on a modern JavaScript framework, or any web app a developer built in the last five years, is likely to be running Node.js somewhere. | SeverityHigh | StateBehind | Fixed in22.23.4, 24.22.1, 26.12.1 | SourceNode.js |
| Published | Software PHP — the language under WordPress and most PHP sites Flagged · Two critical flaws allow code to run on the server with no login Every release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Two faults in PHP itself let an attacker run code on the web server without logging in. The PHP version is usually set by the hosting provider rather than the site owner, so a site stays on an affected version until someone asks for the update. | SeverityCritical | StateBehind | Fixed in8.2.35, 8.3.36, 8.4.27, 8.5.12 | SourcePHP |
| Published | Software Next.js — the framework behind many agency-built React websites Flagged · Two flaws allow code to run on the server with no login 16.0.0–16.4.0 and 15.x before 15.5.28. Next.js 14 and older get no fix. Two separate faults let an attacker run code on the server without logging in, one through cached functions and one through image handling. Agencies have built thousands of UK business websites on Next.js since 2022; the owner usually knows only that it is “a React site”. | SeverityCritical | StateBehind | Fixed in16.4.1, 15.5.28 | SourceNext.js |
| Published | Software Bricksforge — an add-on for the Bricks site builder on WordPress Flagged · Attacks seen from 7 October 3.1.8.9 and earlier. A file-upload fault lets anyone place and run a PHP script on the site. It is a commercial add-on sold alongside the Bricks builder, so it is on sites whose owner never chose it by name. | SeverityCritical | StateBehind | Fixed in3.1.8.10 | SourcePatchstack |
| Published | Software WordPress — the platform behind roughly four in ten websites Flagged · Attacks began within hours of the notice Versions before 7.1.2, 7.0.6, 6.9.9 and 6.8.10. A fault in WordPress itself lets an attacker run code on the server when particular theme and server settings are in place. Automatic updates close it on most sites, but sites where updates were switched off by a developer years ago stay open. | SeverityCritical | StateBehind | Fixed in7.1.2, 7.0.6, 6.9.9, 6.8.10 | SourceWordPress |
| Published | Software Elementor Pro — a page builder on more than six million WordPress sites Versions before 4.2.2. A fault in file handling lets an attacker upload a script and take over the site. Attacks began the day the fix was published. | SeverityCritical | StateBehind | Fixed in4.2.2 | SourceElementor |
| Published | Software Node.js 20 Node.js 20 and every older line. Node.js 20 received its last update on 30 April 2026 and gets no security fix for anything found since, including the October notice above. Hosting providers rarely move a site's runtime without being asked. | SeverityNot rated | StateNo longer supported | Fixed inNo fixed version — move to 22, 24 or 26 | SourceNode.js |
| Published | Software WooCommerce Wholesale Lead Capture — a WooCommerce add-on 2.0.3.1 and earlier. A fault let anyone upload a PHP file to the site; attacks peaked four months after the fix was published and over 100,000 attempts were recorded. Sites that bought the add-on once and never renewed it did not receive the update. | SeverityCritical | StateBehind | Fixed in2.0.3.2 | SourceWordfence |
| Published | Software Modular DS — a WordPress maintenance connector on about 40,000 sites 2.5.1 and earlier. A routing fault let anyone become an administrator of the site with no password. It is a tool agencies install to manage many client sites at once, so the client rarely knows it is there. | SeverityCritical | StateBehind | Fixed in2.5.2 | SourcePatchstack |
| Published | Software PHP 8.1 — the language under WordPress and most PHP sites PHP 8.1 and every older version (8.0, 7.4, 7.3 and earlier). PHP 8.1 received its last security fix on 31 December 2025. Most hosting control panels still offer it, and a site set up before 2024 is very likely to be on 8.1 or older unless someone moved it. | SeverityNot rated | StateNo longer supported | Fixed inNo fixed version — move to 8.2 or later; 8.2 itself leaves support on 31 December 2026 | SourcePHP |
| Published | Software Ubuntu 20.04 LTS — the server operating system under many hosted sites Ubuntu 20.04 without Expanded Security Maintenance. The operating system under a great many hosted sites stopped receiving free security updates on 31 May 2025. A site can run for years on a server nobody has logged into. | SeverityNot rated | StateNo longer supported | Fixed inNo fixed version — move to 22.04 or 24.04 | SourceCanonical |
| Published | Software Node.js 18 Node.js 18. Last updated on 30 April 2025. Still common on sites deployed in 2022 and 2023 and never redeployed. | SeverityNot rated | StateNo longer supported | Fixed inNo fixed version — move to 22, 24 or 26 | SourceNode.js |
| Published | Software PHP 8.0 PHP 8.0. Last security fix 26 November 2023. | SeverityNot rated | StateNo longer supported | Fixed inNo fixed version — move to 8.2 or later | SourcePHP |
| Published | Software PHP 7.4 PHP 7.4 and every 7.x version. Last security fix 28 November 2022. Still the most common unsupported version the Exposure Report meets. | SeverityNot rated | StateNo longer supported | Fixed inNo fixed version — move to 8.2 or later | SourcePHP |
Last checked against each publisher on 27 October 2026. Entries are added as notices are published and removed when a version is withdrawn or a notice is superseded.
Is your site on this list?
The check reads the software versions your site shows to the outside world and sets them against every notice on this page.
Request the free checkWhere this fits
The Website Exposure Report returns these findings for your site as part of the free check; read what it covers on the Website Exposure Report page. Where a version is hidden from the outside, the Digital Trust Audit asks for what could not be seen; see the Digital Trust Audit.