Skip to main content
COSMICBYTEZLABS
NewsSecurityHOWTOsToolsTraining
StudyProjectsNewsletterHire MeAbout
Subscribe

Press Enter to search or Esc to close

News
Security
HOWTOs
Tools
Training
Study
Projects
Newsletter
Hire Me
About
RSS Feed
Reading List
Subscribe

Stay in the Loop

Get the latest security alerts, tutorials, and tech insights delivered to your inbox.

Subscribe NowFree forever. No spam.
COSMICBYTEZLABS

Your trusted source for IT intelligence, cybersecurity insights, and hands-on technical guides.

2614+ Articles
162+ Guides

CONTENT

  • Latest News
  • Security Alerts
  • HOWTOs
  • Checklists
  • Projects
  • Exam Prep

RESOURCES

  • Search
  • Browse Tags
  • Newsletter Archive
  • Reading List
  • RSS Feed

COMPANY

  • About Us
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CosmicBytez Labs. All rights reserved.

System Status: Operational
All tags
13 articles

#Plugin Security

All CosmicBytez Labs articles tagged #Plugin Security, across news, security advisories, how-to guides, and projects.

  • SecurityAug 30, 2026

    MyHome Core WordPress Plugin: Auth Bypass Enables Admin Takeover (CVE-2026-15980)

    CVE-2026-15980 (CVSS 9.8) lets unauthenticated attackers forge activation tokens to hijack WordPress accounts via MyHome Core.

  • SecurityAug 29, 2026

    Uix UserCenter WordPress Plugin: Hardcoded Signing Key Enables Unauthenticated Account Takeover

    CVE-2026-16259 (CVSS 9.8) lets attackers hijack any account on sites running Uix UserCenter — no login needed, and no fix exists yet.

  • SecurityAug 29, 2026

    Icollect Data Collection & Publishing Plugin: Hardcoded Secret Enables Unauthenticated Arbitrary File Read

    CVE-2026-77012 (CVSS 9.3) lets unauthenticated attackers read server files via a WordPress plugin's default publishing secret.

  • SecurityAug 22, 2026

    CVE-2026-78003: Critical SSRF via Path Traversal in Mailgun for WordPress Plugin

    A critical SSRF vulnerability (CVSS 9.8) in Mailgun for WordPress ≤ 2.2.0 lets unauthenticated attackers make server-side requests via path traversal.

  • SecurityAug 21, 2026

    CVE-2026-16576: Dokan WooCommerce Plugin Privilege Escalation to RCE

    A missing capability check in the Dokan multivendor WooCommerce plugin allows Shop Managers to install arbitrary plugins, leading to full site compromise.

  • SecurityJun 27, 2026

    CVE-2026-52884: Notepad++ Trusted Directory Bypass via Path Traversal (CVSS 7.8)

    A path traversal flaw in Notepad++ v8.9.6.1 allows attackers to bypass the trusted directory plugin verification check using path sequences, potentially...

  • NewsJun 6, 2026

    Critical Everest Forms Pro Flaw Exploited to Take Over WordPress Sites

    Hackers are actively exploiting a critical vulnerability (CVE-2026-3300) in the Everest Forms Pro WordPress plugin, enabling them to take complete control of…

  • SecurityJun 5, 2026

    CVE-2026-49777: CVSS 10 Flaw in WooCommerce Product Slider Pro Enables Malware Implantation

    A maximum-severity input validation vulnerability in Product Slider Pro for WooCommerce allows attackers to implant malicious software. Affects all versions…

  • SecurityMay 30, 2026

    CVE-2026-7465: RCE in Spectra Gutenberg Blocks WordPress Plugin (CVSS 8.8)

    A high-severity remote code execution vulnerability in the Spectra Gutenberg Blocks plugin for WordPress allows authenticated Contributor-level attackers...

  • NewsMay 15, 2026

    Avada Builder WordPress Plugin Flaws Allow Site Credential

    Two vulnerabilities in the Avada Builder plugin for WordPress, with an estimated one million active installations, allow hackers to read arbitrary files...

  • SecurityApr 17, 2026

    CVE-2026-6443: WordPress Accordion Plugin Backdoor in Version 1.4.6

    The Accordion and Accordion Slider WordPress plugin version 1.4.6 was sold to a malicious threat actor who embedded a persistent backdoor, granting...

  • NewsMar 29, 2026

    File Read Flaw in Smart Slider Plugin Impacts 500K

    A vulnerability in the Smart Slider 3 WordPress plugin, active on more than 800,000 websites, allows subscriber-level users to read arbitrary files on the...

  • SecurityMar 22, 2026

    CVE-2026-3629: WordPress User Import Plugin Privilege

    The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to 1.29.7, allowing authenticated...