#Plugin
All CosmicBytez Labs articles tagged #Plugin, across news, security advisories, how-to guides, and projects.
- Security
ARVE WordPress Plugin Backdoor Grants Instant Admin Access to ~20,000 Sites
A supply chain attack introduced a backdoor into ARVE – Advanced Responsive Video Embedder version 10.8.7, enabling any attacker to gain full WordPress...
- Security
CVE-2026-14545: TrueBooker WordPress Plugin Lets Anyone Take Over Admin Accounts
An unauthenticated password reset flaw in TrueBooker (before v1.2.4) lets any attacker set an arbitrary password on any WordPress account — including...
- Security
CVE-2026-13439: WordPress Easy Form Builder Unauthenticated Privilege Escalation (CVSS 9.8)
A critical unauthenticated privilege escalation vulnerability in the Easy Form Builder by WhiteStudio WordPress plugin allows attackers to reset admin...
- Security
CVE-2026-15982: WordPress Aimogen Pro Plugin Privilege Escalation (CVSS 9.8)
Critical privilege escalation in the Aimogen Pro WordPress plugin (all versions up to 2.8.4) — missing capability check on AI function allows any...
- Security
ChurchCRM Plugin RCE via Malicious ZIP Upload — CVE-2026-58409
A critical authenticated RCE vulnerability in ChurchCRM allows administrators to achieve remote code execution by uploading a malicious plugin ZIP...
- Security
CVE-2026-7515: BetterDocs Pro WordPress Plugin — Unauthenticated Local File Inclusion
A critical Local File Inclusion vulnerability in the BetterDocs Pro WordPress plugin (up to v3.8.0) allows unauthenticated attackers to include and...
- Security
WordPress Form Notify Plugin Auth Bypass via LINE OAuth
The Form Notify plugin for WordPress is vulnerable to authentication bypass in versions up to and including 1.1.10. Attackers can manipulate...
- Security
CVE-2026-6518: WordPress CMP Plugin Arbitrary File Upload
The CMP Coming Soon & Maintenance Plugin for WordPress contains a critical arbitrary file upload flaw that allows subscriber-level authenticated users to...
- Security
CVE-2025-12886: Oxygen Theme SSRF Allows Unauthenticated
A Server-Side Request Forgery vulnerability in the Oxygen Theme plugin for WordPress (all versions up to 6.0.8) enables unauthenticated attackers to make...
- Security
WordPress Plugin Vulnerability (CVSS 10.0) Under Active
Maximum severity flaw in Modular DS WordPress plugin allows unauthenticated privilege escalation. All versions through 2.5.1 affected with active...