{"openapi":"3.1.0","info":{"title":"WordSec Vulnerability API","version":"1.0.0","summary":"Read-only access to the WordSec WordPress vulnerability catalog.","description":"Two public, unauthenticated, rate-limited JSON endpoints over a catalog of disclosed WordPress plugin, theme and core vulnerabilities. Vulnerability data is © Defiant, Inc. and provided under the Wordfence Intelligence terms; the licence travels with every record in its `copyrights` field. Machine-readable terms for this site are published at /rsl.xml.","contact":{"name":"WordSec","url":"https://wordsec.net/contact"},"license":{"name":"Wordfence Intelligence Terms","url":"https://wordsec.net/rsl.xml"}},"servers":[{"url":"https://wordsec.net"}],"paths":{"/api/vulnerabilities":{"get":{"operationId":"listVulnerabilities","summary":"List vulnerability records, filtered and paginated.","description":"Unknown query parameters are ignored and out-of-range values are clamped rather than rejected, so a request never fails on a bad filter — it returns the default instead. Rate limit: 120 requests per minute per IP.","parameters":[{"name":"page","in":"query","required":false,"description":"1-based page number.","schema":{"type":"integer","minimum":1,"maximum":1000,"default":1}},{"name":"pageSize","in":"query","required":false,"description":"Records per page.","schema":{"type":"integer","minimum":1,"maximum":50,"default":10}},{"name":"sortBy","in":"query","required":false,"description":"Field to sort on.","schema":{"type":"string","enum":["publishedDate","cvssScore","title","cveId","researcher","patchStatus"],"default":"publishedDate"}},{"name":"sortDir","in":"query","required":false,"description":"Sort direction.","schema":{"type":"string","enum":["asc","desc"],"default":"asc"}},{"name":"level","in":"query","required":false,"description":"Filter by CVSS severity band.","schema":{"type":"string","enum":["all","Critical","High","Medium","Low"],"default":"all"}},{"name":"asset","in":"query","required":false,"description":"Filter by affected asset type.","schema":{"type":"string","enum":["all","Plugin","Theme","Core"],"default":"all"}},{"name":"dateRange","in":"query","required":false,"description":"Filter by disclosure recency.","schema":{"type":"string","enum":["all","7d","30d","90d","year"],"default":"all"}},{"name":"search","in":"query","required":false,"description":"Free-text match across title, CVE id and affected software.","schema":{"type":"string","maxLength":100}}],"responses":{"200":{"description":"A page of records.","content":{"application/json":{"schema":{"type":"object","required":["vulnerabilities","total","page","pageSize"],"properties":{"vulnerabilities":{"type":"array","items":{"type":"object","required":["id","title"],"properties":{"id":{"type":"string","description":"Stable catalog identifier."},"title":{"type":"string"},"description":{"type":["string","null"]},"cve":{"type":["string","null"],"examples":["CVE-2024-13922"]},"cve_link":{"type":["string","null"],"format":"uri"},"cvss_score":{"type":["number","null"],"minimum":0,"maximum":10},"cvss_rating":{"type":["string","null"],"examples":["Critical","High","Medium","Low"]},"cvss_vector":{"type":["string","null"]},"cwe_id":{"type":["integer","null"],"description":"CWE identifier, without the CWE- prefix."},"cwe_name":{"type":["string","null"]},"cwe_description":{"type":["string","null"]},"published":{"type":["string","null"],"format":"date-time"},"updated":{"type":["string","null"],"format":"date-time"},"references":{"type":["string","null"],"description":"JSON-encoded array of reference URLs."},"researchers":{"type":["string","null"],"description":"JSON-encoded array of credited researchers."},"affected_software":{"type":["string","null"],"description":"JSON-encoded array of affected assets. Each entry carries type (plugin/theme/core), slug, name, affected_versions and patch state. Version ranges use the half-open [from, to) convention."},"copyrights":{"type":["string","null"],"description":"Attribution required by the data licence."}}}},"total":{"type":"integer","description":"Records matching the filter."},"critical":{"type":"integer"},"page":{"type":"integer"},"pageSize":{"type":"integer"}}}}}},"429":{"$ref":"#/components/responses/RateLimited"},"502":{"$ref":"#/components/responses/Upstream"}}}},"/api/vulnerabilities/stats":{"get":{"operationId":"getVulnerabilityStats","summary":"Aggregate counts across the whole catalog.","description":"Rate limit: 120 requests per minute per IP.","responses":{"200":{"description":"Catalog totals.","content":{"application/json":{"schema":{"type":"object","required":["total","critical","high","medium","low","plugins","themes","cores","researchers"],"properties":{"total":{"type":"integer","description":"Records in the catalog."},"critical":{"type":"integer"},"high":{"type":"integer"},"medium":{"type":"integer"},"low":{"type":"integer"},"plugins":{"type":"integer","description":"Records affecting plugins."},"themes":{"type":"integer"},"cores":{"type":"integer","description":"Records affecting WordPress core."},"researchers":{"type":"integer","description":"Distinct credited researchers."},"lastUpdate":{"type":"string","format":"date-time"}}}}}},"429":{"$ref":"#/components/responses/RateLimited"},"502":{"$ref":"#/components/responses/Upstream"}}}}},"components":{"responses":{"RateLimited":{"description":"Rate limit exceeded. Honour the Retry-After header.","headers":{"Retry-After":{"schema":{"type":"integer"},"description":"Seconds to wait."}},"content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}},"Upstream":{"description":"The catalog is temporarily unavailable.","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"}}}}}}}}}