HF PanelDocsv1.0.0

WordPress vulnerability list

The JSON format of the WordPress vulnerability list, how the official edition imports it and how paid servers fetch it.

HF Panel's WordPress security check compares the installed versions of WordPress, plugins and themes with a vulnerability list kept by the publisher. This page describes the list's JSON format and how it travels.

How the list travels

  1. The publisher's own server (the official edition) imports the list: Server Admin › Hosting › WordPress updates › Vulnerability list › Import, with a JSON file in the format below. The whole list is replaced; a file with one bad entry is refused and nothing changes.

  2. Paid servers fetch it once a day from the licence server:

    http
    POST https://api.hostfog.io:2087/v1/licence/wp-vulns
Content-Type: application/json

{"key": "HF-XXXX-XXXX-XXXX"}

    The answer is the list in the format below for a licence that is active, on trial or in its grace days, and 403 for any other key. The old address /licence/wp-vulns on the licence server's panel works too.

  3. Each server keeps its copy (table wp_vulns) and works out every site's problems again when the list changes.

Format

json
{
  "format": "hostfog-wp-vulns",
  "version": 1,
  "generated": "2026-10-25T00:00:00Z",
  "items": [
    {
      "kind": "plugin",
      "slug": "contact-form",
      "title": "Stored cross-site scripting in the form editor",
      "severity": "high",
      "min": "",
      "max": "5.9.2",
      "max_inclusive": false,
      "fixed": "5.9.2",
      "link": "https://example.com/advisories/42",
      "id": "HF-2026-0042"
    }
  ]
}
Field What it means
format, version always hostfog-wp-vulns and 1
generated when the list was made (shown on the servers)
kind plugin, theme or core (WordPress itself; slug is then wordpress and may be left out)
slug the plugin's or theme's folder name, lower case
title what the problem is (up to 300 characters)
severity critical, high, medium, low or empty
min the first affected version (empty = every version up to max)
max the end of the affected range; with max_inclusive: true that version is affected too
fixed the first safe version; empty when there is no fix yet (the screens then offer Deactivate)
link where to read more (http:// or https://; anything else is dropped)
id your own reference (up to 60 characters)

An entry needs min and/or max. Versions are compared the way WordPress compares them, so 6.6.2 < 6.6.10 and 1.0-beta < 1.0. A list may hold up to 50,000 entries.