14 stories
A core flaw exploited within hours of its patch, a WooCommerce plugin attacked seven months after its fix. How attackers pick WordPress sites, and how to check yours for free without installing anything.
One landing page, one prompt, one AI. Built by hand through WPVibe, by hand through Respira, and with Respira Exhale, on Elementor, Bricks, Divi, Breakdance, Beaver Builder and Gutenberg. Time, tool calls, cost, how close each page came to the file, with screenshots and links to every page.
A company's terms and privacy pages started answering "No results found". The cause was a plugin WordPress was running and wp-admin was not showing, and one rewrite rule placed ahead of the page rule.
Respira Exhale turns a finished HTML page, written by ChatGPT, Claude or a designer, into a page in your WordPress builder's own blocks, in seconds, with no AI in the middle and no tokens from your plan.
An attacker reached the vendor's update server and two builds went out with a web shell in them. The files, the directory and the database rows to look for, why the version number cannot clear you, and what to do if you find one.
Thirty-five critical records in twenty-one days. The plugins with real install numbers behind them, the version that fixes each one, the core release nobody should miss, and the one that no version can fix.
An agency owner had trustees reviewing a staging site and no good way to collect what they said. Two days later the plugin mints a signed link that opens the page with a review bar, every note lands anchored to its element, and the agent applies the notes on a duplicate.
Anthropic measured it: humans clicking approval prompts caught 13.6% of dangerous commands, falling to 5% after fifty prompts. Auto mode, Guardian and always-on cloud agents are the industry removing a button that was not working. What safety means for a WordPress site once nobody is watching.
WordPress.com gave sites a persistent AI memory, core is building wp_knowledge, and self-hosted sites have had Resonance since 3 August. What the three share, why memory that travels with the site beats memory that belongs to one assistant, and the one thing a memory cannot do by being read.
One saved design direction per site: palette, fonts, spacing and the don’ts, written into the builder’s own token stores, enforced on every AI build, and verified against the real rendered page with screenshots attached. With a live pane showing the actual page converge as the agent works.
The Safety & Security hub watches WordPress core, plugin and WooCommerce advisories across every connected site and walks you through remediation. Included in the dashboard for paid plans, in Labs.
Your studio's name, logo, accent and support address on the plugin your clients open in wp-admin, with Respira gone from the plugins list and the front end. Display-only, fully reversible, set once and synced to every site. From €200 a year, and the early-adopter roadmap is public.
Canopy adds native WordPress Full Site Editing, now usually called the Site Editor, alongside sixteen page builders: block templates, synced patterns, navigation and design tokens. It also fixes two bugs found by auditing the safety layer itself.
Make AI-assisted Elementor edits through an approved workflow: native widget edits validated against Elementor’s controls, on a duplicate, with one-click rollback. Layout control stays with you.
Showing 14 of 14 stories
You're all caught up.
Get the top AI news and tools straight to your inbox every week.
Weekly · AI news
Join 15,000+ AI enthusiasts
