Patchstack

WP SecurityUnverified

Patchstack solves a specific WordPress problem: the gap between a vulnerability being disclosed and the plugin author shipping a fix. The platform maintains the largest dedicated database of WordPress vulnerabilities and ships virtual patches at the firewall layer so sites are protected during the days or weeks before an official update arrives.

patchstack.com ↗2017 (Estonia)

Visit Patchstack ↗← All security solutions Claim this listing →

Profile unclaimed

If you represent Patchstack, claiming is free and adds a Verified badge to this security profile. Start verification →

HOW IT WORKS

Underneath, Patchstack runs a vetted security-researcher community and a managed Vulnerability Disclosure Programme (mVDP) where plugin authors pay for ongoing security review and a fast-track disclosure path. That feeds the threat intelligence the firewall consumes. For agencies and hosts running hundreds of WordPress sites, the proposition is straightforward: cover the vulnerability-window risk without manually monitoring every plugin in the stack.

Patchstack is a virtual-patching and threat-intel layer, not a server-level WAF or a malware scanner. It pairs well with a server-level stack (Imunify360, BitNinja) and a scanner (Wordfence, MalCare). It is not a substitute for either.

Category context: Plug-in or service that runs inside the WordPress install. Application-level protection; the user controls it directly.

WHAT IT DOES

Vulnerability database (largest dedicated WP CVE feed)
Virtual patches for unpatched plugin CVEs
Bug-bounty marketplace (mVDP) connecting researchers and plugin authors
Compliance reporting and audit logs

BEST FOR

Agencies managing 25+ WordPress sites where plugin sprawl is unavoidable
Hosts who want to advertise virtual-patching as a value-add to WordPress customers
Plugin authors who need ongoing security review and CVE coordination

PATCHSTACK FAQ

What is Patchstack?

Patchstack is a WordPress security platform built around a vulnerability database and a virtual-patching engine. When a vulnerability is disclosed in a WordPress plugin, Patchstack pushes a firewall rule that blocks exploitation immediately, so sites are protected during the window between disclosure and the plugin author shipping an official fix. It also runs a managed Vulnerability Disclosure Programme (mVDP) and a researcher community that feeds the threat intel underneath.

Is Patchstack free?

Patchstack offers a free tier that covers vulnerability monitoring and basic protection for a single site. Paid plans start around $5 per site per month for the full virtual-patching engine, with agency and host volume pricing available. Plugin authors using the mVDP pay an annual fee for ongoing security review.

Patchstack vs Wordfence: which should I use?

They solve different problems. Wordfence is an application-level firewall and malware scanner that runs inside the WordPress install and catches a wide range of attack patterns. Patchstack is a virtual-patching layer focused specifically on the disclosed-but-unpatched vulnerability window. Serious WordPress stacks often run both, because they overlap less than the marketing implies.

Does Patchstack scan for malware?

Patchstack focuses on prevention through virtual patching and vulnerability monitoring rather than post-infection malware scanning. For malware detection and cleanup, pair it with a dedicated scanner such as Wordfence, MalCare, or a server-level tool like Monarx or Imunify360.

Find a provider

Domains

Free tools

Rankings & research

Learn

For providers