All CosmicBytez Labs articles tagged #WordPress, across news, security advisories, how-to guides, and projects.
CVE-2026-14494 (CVSS 9.8) lets unauthenticated attackers upload PHP webshells through Sigma Forms Pro's default form templates. No patch yet.
CVE-2026-15369 (CVSS 9.8) lets unauthenticated attackers self-assign the Administrator role during WooCommerce checkout in Addify's plugin.
CVE-2026-15980 (CVSS 9.8) lets unauthenticated attackers forge activation tokens to hijack WordPress accounts via MyHome Core.
Five critical flaws in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP enable auth bypass, takeover, and RCE.
CVE-2026-82222 chains PHP object injection and an auth-bypass bug in GiveWP, letting attackers run OS commands on 100,000+ WordPress donation sites.
CVE-2026-16259 (CVSS 9.8) lets attackers hijack any account on sites running Uix UserCenter — no login needed, and no fix exists yet.
CVE-2026-16947 (CVSS 9.1) lets attackers redirect payment verification requests and forge success responses on WooCommerce stores.
CVE-2026-77012 (CVSS 9.3) lets unauthenticated attackers read server files via a WordPress plugin's default publishing secret.
Critical unauthenticated SQL injection (CVSS 9.3) in the WordPress plugin Visitor Traffic Real Time Statistics Pro ≤ 11.17. Patch to 11.18.
Critical unauthenticated privilege escalation (CVSS 9.8) in WordPress plugin ACPT (Pro) ≤ 2.0.63. No official patch yet — Patchstack has a mitigation rule.
Wordfence's AI agent chained six flaws in the Avada theme into an unauthenticated RCE, patched in Avada 7.16.1 for 1M+ sites.
CVE-2026-19632 leaks a plaintext admin password-reset key via an unauthenticated AJAX action in TranslatePress, enabling full site takeover.
CVE-2026-78477 allows unauthenticated attackers to escalate to WordPress administrator in Jawn theme versions up to 1.4.2, CVSS 9.8 critical.
PPWP WordPress plugin up to 1.9.18 allows contributor-level PHP object injection via deserialization, enabling RCE on affected sites.
Security Hardener plugin up to 2.4.4 overwrites REST endpoint permissions via rest_endpoints filter, bypassing all registered auth callbacks.
A critical SSRF vulnerability (CVSS 9.8) in Mailgun for WordPress ≤ 2.2.0 lets unauthenticated attackers make server-side requests via path traversal.
A missing capability check in the Dokan multivendor WooCommerce plugin allows Shop Managers to install arbitrary plugins, leading to full site compromise.
CVE-2026-32475 (CVSS 9.0): Unauthenticated attackers can upload PHP webshells via a loop desync flaw in Elementor Pro's file upload field.
A CVSS 9.8 unauthenticated remote code execution flaw in JetEngine plugin <= 3.8.14 lets attackers fully compromise WordPress sites.
An unauthenticated SQL injection flaw (CVSS 9.3) in Maps Marker Pro <= 4.32 exposes WordPress databases to full read and write access.
Critical WordPress plugin flaw lets unauthenticated attackers update arbitrary options, enabling privilege escalation and full site takeover.
An unauthenticated PHP Object Injection flaw (CVSS 9.8) in FundEngine <= 1.7.9 allows remote attackers to execute arbitrary code without credentials.
CVE-2026-32474 allows Contributor-level users to upload arbitrary files in Templatiq <= 0.2.5, enabling remote code execution. CVSS score: 9.9.
CVE-2026-15748 (CVSS 9.8) in Forminator Forms allows unauthenticated PHP webshell uploads for full RCE on 600,000+ WordPress sites. Patch to 1.56.2 now.
A critical unauthenticated PHP object injection flaw in the ARForms WordPress plugin (CVSS 9.8) allows arbitrary code execution via deserialization.
A high-severity RCE flaw (CVSS 8.8) in the Query Wrangler WordPress plugin lets authenticated attackers inject and execute arbitrary PHP via a missing capability check.
A CVSS 9.1 flaw in ProSolution WP Client lets unauthenticated attackers delete arbitrary files on WordPress servers, potentially wiping installations.
CVE-2026-15002 is a stored XSS flaw (CVSS 7.2) in the Autopay WooCommerce plugin, letting attackers inject persistent scripts via the CSS editor POST parameter.
CVSS 7.5 flaw in Real Estate Manager Pro for WordPress lets attackers escalate privileges by exploiting an attachment ID and user ID confusion bug.
A CVSS 9.8 flaw in TrueBooker for WordPress allows unauthenticated attackers to take over any user account via a vulnerable AJAX handler.
CVSS 8.8 flaw in Templately for WordPress lets authenticated subscribers execute arbitrary code via a filename validation bypass in file upload.
Critical CVSS 9.1 flaw in WordPress Link Library plugin allows unauthenticated attackers to delete arbitrary server files, risking full site takeover.
CVSS 9.8 flaw in WordPress Pods plugin lets unauthenticated users escalate privileges via a flawed AJAX authorization router in versions up to 3.3.9.
Critical unauthenticated arbitrary file deletion in WordPress RapiSafe plugin v1.0.4 and below allows attackers to delete any file on the server.
High-severity unauthenticated SQL injection in Object Sync for Salesforce plugin allows attackers to extract data via a misconfigured REST API push endpoint.
Critical authentication bypass in 6Storage Rentals WordPress plugin v2.27.0 allows unauthenticated users to create privileged accounts via exposed AJAX handler.
Critical auth bypass in User Session Synchronizer plugin v1.4.0 lets unauthenticated attackers hijack any WordPress account via session sync on every request.
Critical CVSS 9.8 flaw in WordPress Wishlist Member plugin allows unauthenticated account takeover in versions up to 3.34.1.
The Link Factory WordPress plugin is a supply-chain backdoor. Operator-controlled REST API lets attackers run arbitrary commands. Remove it immediately.
High-severity reflected XSS in Samex and M.Anh WooCommerce themes allows attackers to inject malicious scripts via crafted URLs.
A CVSS 9.8 type juggling flaw in Customer Email Verification for WooCommerce lets unauthenticated attackers take over any customer account.
High-severity auth bypass in the VentraConnect Social Login plugin allows unauthenticated attackers to take over any WordPress account.
Cybersecurity researchers have uncovered a supply chain compromise targeting WordPress plugin vendor BdThemes, where attackers poisoned JSON configuration files to silently create rogue administrator accounts — without touching a single line of source code.
The HT Contact Form plugin before 2.9.3 allows any unauthenticated user to read saved form drafts containing visitor names, emails, and physical addresses via a completely unprotected API endpoint.
A critical improper authentication vulnerability in WP Events Manager for WordPress allows unauthenticated attackers to register for paid events without payment by manipulating the quantity parameter. Fixed in version 2.2.5.
A critical unauthenticated account takeover vulnerability in the TrueBooker Appointment Booking plugin for WordPress allows attackers to reset any user's password, including administrators, without verification. CVSS 9.8.
A second critical flaw in the TrueBooker Appointment Booking WordPress plugin allows unauthenticated attackers to change the password of any user, including administrators, due to missing authorization checks. CVSS 9.8.
A supply chain attack introduced a backdoor into ARVE – Advanced Responsive Video Embedder version 10.8.7, enabling any attacker to gain full WordPress admin access with a single HTTP request. Wordfence PRISM detected the compromise within two hours. The plugin has been removed from WordPress.org.
A critical unauthenticated privilege escalation flaw (CVSS 9.8) in Kadence WooCommerce Email Designer <= 1.5.19 allows attackers to gain admin access with no credentials.
A CVSS 9.8 unauthenticated PHP object injection flaw in Ajax Search Lite <= 4.14.4 exposes 80,000+ WordPress sites to potential remote code execution via POP chain gadgets.
An unauthenticated SQL injection vulnerability (CVSS 9.1) in the WPCargo Track & Trace WordPress plugin before version 8.0.4 allows attackers to read and manipulate database contents without any credentials.
A high-severity directory traversal vulnerability in the CubeWP Framework plugin for WordPress allows unauthenticated attackers to read arbitrary files on the server, potentially exposing credentials, configuration data, and sensitive application secrets.
The Single Sign On For TNG plugin for WordPress contains a critical authentication bypass (CVSS 9.8) allowing unauthenticated attackers to reset any user's password via a vulnerable AJAX handler. All versions up to 2.0.0 are affected.
The Kali Forms Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution (CVSS 8.1) in all versions up to 2.4.20. Insufficient validation of the thisPermalink field allows attackers to overwrite a trusted callable and execute arbitrary code.
The User Access Manager plugin for WordPress (up to v2.3.15) is vulnerable to unauthenticated directory traversal via the 'uamgetfile' parameter, allowing attackers to read arbitrary files on the server.
A critical authentication bypass vulnerability in the WooCommerce - Social Login WordPress plugin allows unauthenticated attackers to log in as any registered user by exploiting a missing JWT signature verification in the Apple login handler.
A high-severity privilege escalation vulnerability in the Subscriptions for WooCommerce plugin allows authenticated users to elevate their role to administrator by manipulating membership plan metadata.
A critical unauthenticated file deletion vulnerability in the FormGent WordPress plugin allows attackers to delete arbitrary files without authentication, potentially leading to full site compromise.
A missing authorization vulnerability in the Subscriptions for WooCommerce plugin allows authenticated users with minimal privileges to perform unauthorized actions on WordPress sites running versions up to 2.0.0.
A critical missing authorization vulnerability in the Spreadsheet Price Changer for WooCommerce plugin allows unauthenticated attackers to create admin accounts on affected WordPress sites, scoring a near-perfect CVSS 9.8.
A CVSS 9.8 unauthenticated remote code execution vulnerability in the Admin and Site Enhancements (ASE) Pro WordPress plugin allows attackers to execute arbitrary code via a publicly accessible nonce bypass in the recursive_html function.
The Streamit WordPress theme through version 4.5.0 exposes an unauthenticated AJAX route with no authorization or nonce verification, letting any anonymous visitor call arbitrary PHP functions with attacker-controlled arguments — a critical CVSS 9.8 flaw.
An unauthenticated password reset flaw in TrueBooker (before v1.2.4) lets any attacker set an arbitrary password on any WordPress account — including administrators — and take full control of the site.
A CVSS 9.3-rated unauthenticated SQL injection vulnerability in the MapSVG WordPress plugin (versions up to 8.14.0) allows remote attackers to read and manipulate the underlying database without any login credentials.
Attackers are actively chaining CVE-2026-60137 and CVE-2026-63030 just three days after disclosure, targeting one of the largest attack surfaces on the internet.
A critical privilege escalation flaw in the MemberGlut WordPress plugin allows unauthenticated users to register with any role — including administrator — leading to full site compromise.
A critical unauthenticated AJAX vulnerability in the Masteriyo LMS WordPress plugin allows attackers to terminate any user's session — including administrators — without any credentials.
A critical authentication bypass in the WeChat QR login WordPress plugin allows unauthenticated attackers to forge login events for any account — the webhook signature check always passes and login codes are leaked in responses.
A critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Realtyna Organic IDX + WPL Real Estate WordPress plugin (before v5.3.0) exploits hardcoded credentials shipped identically across all installations.
A critical unauthenticated arbitrary file write vulnerability in the FacturaONE para WooCommerce con VeriFactu plugin (before v5.37) allows attackers to write arbitrary files due to an empty cryptographic key in the default unconfigured state.
A high-severity PHP Object Injection vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress allows authenticated attackers with Subscriber-level access to inject PHP objects and potentially achieve remote code execution via a POP chain in versions up to 6.2.6.
A high-severity vulnerability in WPForms Pro allows unauthenticated attackers to upload malicious files and achieve remote code execution. File type...
An unauthenticated SQL injection flaw with a CVSS score of 9.1 affects the Project Management, Bug and Issue Tracking Plugin for WordPress before version...
A critical unauthenticated arbitrary file upload vulnerability in the GoDAM WordPress media library plugin allows attackers to upload malicious files and...
A critical unauthenticated PHP code injection vulnerability in the Customer Support Ticket System & Helpdesk WordPress plugin allows attackers to execute...
A critical authentication bypass in the WordPress SAML Single Sign On plugin allows unauthenticated attackers to log in as any user, including...
The Security Ninja Premium WordPress plugin before version 5.290 contains a critical authentication flaw that allows attackers to bypass two-factor...
A CVSS 9.3 critical stored XSS vulnerability in the Ninja Forms WordPress plugin affects versions 3.10.4 through 3.14.9. The flaw requires no...
A CVSS 9.3 critical incorrect authorization vulnerability in Ninja Forms 3.14.8 and prior for WordPress Multisite allows a subsite administrator to...
Attackers are exploiting two chained critical WordPress vulnerabilities that enable unauthenticated remote code execution. A public exploit has triggered...
A critical unauthenticated privilege escalation vulnerability in the Easy Form Builder by WhiteStudio WordPress plugin allows attackers to reset admin...
A single request shouldn't be able to do this much. This week delivered pre-authenticated WordPress RCE, dual SonicWall zero-days exploited since June, a...
A stored cross-site scripting vulnerability in the Unlimited Elements for Elementor WordPress plugin (before 2.0.11) allows unauthenticated attackers to...
A server-side request forgery vulnerability in the Kirki Customizer Framework WordPress plugin before 6.0.12 allows unauthenticated attackers to make the...
Public exploits have been released for the critical wp2shell remote code execution vulnerabilities in WordPress Core, putting millions of sites at...
A critical unauthenticated remote code execution vulnerability in WordPress core affects all 6.9 and 7.0 installations. WordPress force-pushed emergency...
A high-severity privilege escalation flaw in WPFunnels for WordPress allows attackers to update arbitrary site options via an unvalidated REST callback,...
Critical privilege escalation in the Aimogen Pro WordPress plugin (all versions up to 2.8.4) — missing capability check on AI function allows any...
The Happy Coders OTP Login for WooCommerce plugin before 2.8 allows unauthenticated attackers to bypass OTP verification and log in as any WordPress user,...
The miniOrange SAML Single Sign On plugin for WordPress through version 5.4.3 allows unauthenticated attackers to log in as any user via an RSA-to-HMAC...
Security firm Intruder built an AI-powered system that combines code slicing with large language models to automatically discover complex software...
The User Registration & Membership WordPress plugin before 5.2.2 fails to verify PayPal webhook signatures, allowing unauthenticated attackers to forge...
The Australian Cyber Security Centre has issued an alert about a coordinated global campaign actively exploiting unpatched vulnerabilities in WordPress,...
A critical authentication bypass chain in the miniOrange Social Login and Register WordPress plugin allows unauthenticated attackers to crack a trivially...
A critical CVSS 8.8 remote code execution vulnerability in WP Ultimate CSV Importer allows unauthenticated attackers to execute arbitrary PHP code on...
An unprotected 800MB server left open for three weeks exposed the full toolkit of a webshell access brokerage operation targeting 1.4 million domains....
A critical unauthenticated arbitrary file upload vulnerability in the Super Forms plugin for WordPress (CVSS 9.8) allows attackers to upload and execute...
A critical arbitrary file upload vulnerability in the Blocksy Companion WordPress plugin (versions up to 2.1.46) allows unauthenticated attackers to...
A critical unauthenticated arbitrary file upload flaw (CVSS 9.8) in the Instant Appointment WordPress plugin allows attackers to upload and execute...
A critical CVSS 9.8 authorization bypass in the WP Learn Manager WordPress plugin allows unauthenticated attackers to install and activate arbitrary...
A critical CVSS 9.1 vulnerability in the Simple Coherent Form WordPress plugin allows unauthenticated attackers to delete arbitrary files on the server,...
A critical CVSS 9.8 vulnerability in the Eventer WordPress plugin exposes plaintext password reset keys in user meta, allowing unauthenticated attackers...
A local file inclusion vulnerability in the WANotifier WordPress plugin (before v2.6) allows any authenticated subscriber-level user to include and...
A CVSS 9.8 critical SQL injection in the Destekz plugin by Raera - Ankara Web Design allows unauthenticated remote attackers full database access. The...
A CVSS 9.1 critical unauthenticated arbitrary file deletion vulnerability in the Printcart Web to Print Product Designer for WooCommerce plugin affects...
A high-severity arbitrary function call vulnerability in the YouTube Showcase plugin allows authenticated attackers to invoke arbitrary PHP functions via...
A critical unauthenticated SQL injection vulnerability in the EventON WordPress Virtual Event Calendar Plugin affects versions up to 5.0.11, exposing...
A critical CVSS 9.8 vulnerability in the ProfileGrid WordPress plugin allows unauthenticated attackers to take over any user account and escalate...
A CVSS 9.9 critical vulnerability in the Paid Videochat Turnkey Site WordPress plugin allows authenticated performer-role users to delete arbitrary files...
A high-severity authenticated file deletion vulnerability in the nmedia Frontend File Manager Plugin for WordPress allows subscribers to delete any file...
A critical unauthenticated privilege escalation flaw in the WordPress Invoice Generator plugin allows any attacker to take over administrator accounts via...
A critical unauthenticated SQL injection vulnerability (CVSS 9.3) in the JetBooking WordPress plugin affects all versions up to 4.0.4.1, potentially...
A Russian IAB harvests 110M credentials from FortiGate firewalls; the Icarus group drains hundreds of Salesforce orgs via Klue OAuth tokens; a 29-year-old...
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack, with attackers injecting backdoor code into Pro plugin releases...
Active exploitation of CVE-2026-4020 in the Gravity SMTP WordPress plugin has generated over 17 million malicious requests, allowing unauthenticated...
In a major Operation Endgame action, law enforcement and private partners seized 106 SocGholish command-and-control servers and domains, with...
A joint law enforcement operation led by Dutch authorities and including partners from Canada, Germany, and the US has disrupted SocGholish malware...
A critical Local File Inclusion vulnerability in the BetterDocs Pro WordPress plugin (up to v3.8.0) allows unauthenticated attackers to include and...
International law enforcement cleaned nearly 15,000 malware-infected WordPress websites and took down more than 100 servers linked to the SocGholish...
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack that distributed infected releases to paying customers via the...
A critical blind SQL injection vulnerability in The Events Calendar WordPress plugin by StellarWP affects versions 6.15.12 through 6.16.2, allowing...
A critical code injection vulnerability in the RD Station WordPress plugin allows unauthenticated remote code execution through Remote File Inclusion,...
A critical unauthenticated SQL injection vulnerability in GEO my WordPress versions 4.5.5 and earlier allows attackers to extract database contents...
DragonForce hides C2 inside Microsoft Teams relay traffic; a SearchLeak attack weaponizes M365 Copilot for one-click data exfiltration; iRhythm confirms...
New analysis reveals the 'Lorem Ipsum' malware campaign has adopted ClickFix social engineering as its primary delivery mechanism, leveraging compromised...
WordPress CP Polls plugin version 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through...
A critical unauthenticated PHP Object Injection vulnerability in the Broadcast Live Video WordPress plugin (versions < 7.1.3) carries a CVSS score of 9.8...
A critical unauthenticated SQL injection vulnerability (CVSS 9.3) in the InPost Gallery WordPress plugin allows attackers to extract sensitive database...
A high-severity unauthenticated remote code execution vulnerability (CVSS 8.8) in Premmerce Dev Tools for WordPress allows attackers to execute arbitrary...
A critical unauthenticated vulnerability in the WP Maps Pro WordPress plugin before 6.1.1 allows any visitor to create an administrator account and...
The Bookly scheduling plugin for WordPress contains a stored cross-site scripting vulnerability in versions up to 27.2, allowing unauthenticated attackers...
A critical CVSS 9.9 argument injection vulnerability in WordPress Toolkit before 6.11.0 allows remote authenticated users to bypass cross-tenant...
A critical unauthenticated privilege escalation vulnerability in the Doctreat Core WordPress plugin allows attackers to register with elevated roles,...
Hackers are actively exploiting a critical vulnerability (CVE-2026-3300) in the Everest Forms Pro WordPress plugin, enabling them to take complete control of…
A high-severity arbitrary file upload vulnerability in the MDJM Event Management plugin for WordPress allows authenticated attackers to upload malicious files…
A high-severity PHP Object Injection vulnerability in the Admin Columns WordPress plugin (versions up to 7.0.18) allows authenticated attackers to achieve…
A high-severity privilege escalation vulnerability in the Booking Package WordPress plugin allows unauthenticated or low-privileged attackers to take over…
A maximum-severity input validation vulnerability in Product Slider Pro for WooCommerce allows attackers to implant malicious software. Affects all versions…
Hackers are actively exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the widely-used Kirki Customizer Framework plugin for…
The Kirki Freeform Page Builder plugin for WordPress (versions 6.0.0–6.0.6) allows unauthenticated attackers to take over any user account during password…
The Really Simple Security WordPress plugin before 9.5.10.1 fails to enforce the second-factor challenge on two REST API endpoints, allowing attackers with a…
Hackers are actively exploiting a critical vulnerability in the WP Maps Pro WordPress plugin that allows unauthenticated attackers to create rogue…
A critical CVSS 9.1 access control flaw in the WP Travel Pro WordPress plugin allows unauthenticated attackers to delete any user account — including...
A broken authentication check in the Simple History WordPress plugin (versions up to 5.26.0) allows Subscriber-level users to take over any WordPress...
A high-severity remote code execution vulnerability in the Spectra Gutenberg Blocks plugin for WordPress allows authenticated Contributor-level attackers...
The GEO my WP WordPress plugin (versions up to 4.5.5) is vulnerable to unauthenticated SQL injection via the swlatlng and nelatlng parameters, which...
A critical authentication bypass (CVSS 9.8) in the OTP Login With Phone Number WordPress plugin allows unauthenticated attackers to log in as any user due...
A critical unauthenticated privilege escalation flaw in WP Maps Pro for WordPress (CVSS 9.8) allows attackers to create administrator accounts without...
A critical blind SQL injection vulnerability in the WP Directory Kit WordPress plugin allows unauthenticated attackers to exfiltrate the entire WordPress...
A CVSS 7.5 SQL injection vulnerability in the WP ERP Pro WordPress plugin (all versions up to 1.5.1) allows unauthenticated attackers to extract sensitive...
A critical CVSS 9.8 vulnerability in the Avada Builder (fusion-builder) WordPress plugin allows unauthenticated attackers to execute arbitrary PHP...
The Boost plugin for WordPress versions up to 2.0.3 is vulnerable to PHP Object Injection via deserialization of the STYXKEY-BOOST_USER_LOCATION cookie,...
The Fortis for WooCommerce WordPress plugin before version 1.3.1 exposes sensitive API keys to unauthenticated attackers, enabling unauthorized access to...
A missing WordPress capability check in the AI Engine plugin's MCP OAuth bearer-token path allows any authenticated user to escalate privileges to...
Attackers are actively exploiting a critical vulnerability in the Funnel Builder WordPress plugin to inject malicious JavaScript into WooCommerce checkout...
The Form Notify plugin for WordPress is vulnerable to authentication bypass in versions up to and including 1.1.10. Attackers can manipulate...
Two vulnerabilities in the Avada Builder plugin for WordPress, with an estimated one million active installations, allow hackers to read arbitrary files...
A critical vulnerability in the Funnel Builder plugin for WordPress is being actively exploited to inject malicious JavaScript into WooCommerce checkout...
A CVSS 9.1 authorization bypass in InfusedWoo Pro for WordPress lets unauthenticated attackers permanently delete arbitrary data across all installations...
A high-severity SQL injection vulnerability (CVE-2026-2993) in the AI Chatbot & Workflow Automation by AIWU WordPress plugin allows unauthenticated...
TheCartPress WordPress plugin 1.5.3.6 allows unauthenticated attackers to register new administrator accounts by exploiting the AJAX handler with a...
MStore API 2.0.6 for WordPress allows unauthenticated attackers to upload arbitrary PHP files via the REST API config_file endpoint, achieving remote code...
The Custom css-js-php WordPress plugin through version 2.0.7 fails to sanitize user input before using it in a SQL query, and passes the result to dynamic...
The Brizy Page Builder plugin for WordPress contains a critical unauthenticated Stored Cross-Site Scripting flaw in versions up to 2.8.11, enabling...
A critical unauthenticated arbitrary file upload vulnerability in the User Registration Advanced Fields plugin for WordPress allows attackers to upload...
A critical authentication bypass in the User Verification by PickPlugins plugin for WordPress allows unauthenticated attackers to bypass OTP verification...
A critical CVSS 9.8 authentication bypass in the WordPress Temporary Login plugin (versions up to 1.0.0) allows unauthenticated attackers to gain...
WebPros cPanel, WHM, and WP2 (WordPress Squared) contain a critical authentication bypass in the login flow, allowing unauthenticated remote attackers to...
A critical code injection vulnerability in the FunnelFormsPro WordPress plugin through version 3.8.1 allows remote code inclusion, enabling attackers to...
Threat actors are mass-exploiting a critical unauthenticated file upload vulnerability in the Breeze Cache WordPress plugin, uploading PHP webshells to...
A critical unauthenticated file upload vulnerability in the Breeze Cache WordPress plugin allows attackers to upload arbitrary files to affected servers...
A critical CVSS 9.1 authorization bypass in the WordPress Create DB Tables plugin (all versions up to 1.2.1) allows unauthenticated users to create or...
The CMP Coming Soon & Maintenance Plugin for WordPress contains a critical arbitrary file upload flaw that allows subscriber-level authenticated users to...
The Accordion and Accordion Slider WordPress plugin version 1.4.6 was sold to a malicious threat actor who embedded a persistent backdoor, granting...
A critical CVSS 9.8 vulnerability in the Quick Playground WordPress plugin (versions up to 1.3.1) allows unauthenticated attackers to upload arbitrary...
A critical privilege escalation vulnerability in the Users Manager – PN WordPress plugin (v1.1.15 and below) allows unauthenticated attackers to update...
Attackers are actively exploiting a critical unauthenticated arbitrary file upload vulnerability in the Ninja Forms File Uploads premium add-on for...
Storm-1175 runs sub-24-hour Medusa ransomware campaigns using zero-days; the FBI IC3 reports a record $21 billion in US cybercrime losses for 2025; North...
A high-severity authorization flaw in the ProfilePress WordPress plugin (up to v4.16.11) lets unauthenticated or low-privilege users bypass membership...
A high-severity Insecure Direct Object Reference vulnerability in the WCFM Frontend Manager for WooCommerce plugin (up to v6.7.25) lets authenticated...
The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows an editor-level attacker to achieve Remote Code Execution by logging a crafted...
A vulnerability in the Smart Slider 3 WordPress plugin, active on more than 800,000 websites, allows subscriber-level users to read arbitrary files on the...
A Server-Side Request Forgery vulnerability in the Oxygen Theme plugin for WordPress (all versions up to 6.0.8) enables unauthenticated attackers to make...
The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to 1.29.7, allowing authenticated...
A CVSS 9.8 deserialization vulnerability in the Shinetheme Traveler WordPress plugin allows unauthenticated remote attackers to inject arbitrary PHP...
The Tutor LMS Pro WordPress plugin's Social Login addon fails to verify OAuth token email matches the login request, allowing unauthenticated attackers to...
A cross-site request forgery vulnerability in WooCommerce versions 5.4.0 through 10.5.2 allows attackers to abuse the Store API's batch endpoint to...
A critical unauthenticated arbitrary file upload vulnerability in the WPvivid Backup & Migration plugin allows remote code execution on over 900,000...
Maximum severity flaw in Modular DS WordPress plugin allows unauthenticated privilege escalation. All versions through 2.5.1 affected with active...