If you find a security problem in a Plugevity plugin or in this site, please tell us privately first. We will work with you to fix it and credit you if you want.
How to report
Email security@plugevity.com with:
- the plugin and version (or the URL),
- what an attacker could do,
- steps to reproduce, or a proof of concept,
- whether and how you want to be credited.
Reports in English or Portuguese are fine. You can also report through the Wordfence or Patchstack programs; we accept reports from both.
What we commit to
| Step | Target |
|---|---|
| Acknowledge your report | within 3 business days |
| Confirm whether it is a vulnerability, with a first assessment | within 10 business days |
| Ship a fix for a confirmed high or critical issue | as fast as possible, aiming for 30 days |
| Publish an advisory and credit you | after the fix is released |
We will keep you informed along the way and agree a disclosure date with you.
Safe harbor
We will not take legal action against anyone who, in good faith, finds and reports a vulnerability following this page. Please:
- only test against your own WordPress installations, never someone else’s site,
- do not access, change or delete other people’s data,
- give us reasonable time to fix the issue before you disclose it.
Out of scope
Reports from automated scanners with no demonstrated impact, missing security headers on their own, and social engineering of Plugevity people.
This policy is also published as /.well-known/security.txt.
Last updated: November 11, 2026