Category: Security
-
CVE-2026-82222: GiveWP Plugin RCE — Update to 4.16.7.2 Immediately
CVE-2026-82222 (CVSS 10.0) lets an unauthenticated attacker run arbitrary commands on any GiveWP donation site with one live…
-
CVE-2026-8206: Kirki Plugin Admin Takeover — Update to 6.0.7 Now
CVE-2026-8206 (CVSS 9.8) lets an unauthenticated attacker hijack any admin account on 500,000+ sites using the Kirki customizer…
-
CVE-2026-15748: Forminator Forms RCE — Update to 1.56.2 Now
CVE-2026-15748 (CVSS 9.8) lets an unauthenticated attacker upload a PHP webshell through Forminator’s own file-upload field. 300,000+ sites…
-
CVE-2026-19949: All-in-One WP Migration SQLi — Update to 7.110
CVE-2026-19949 (CVSS 8.8) is a second-order SQL injection in a plugin running on 3M+ sites. Only 35% have…
-
CVE-2026-32475: Elementor Pro RCE — Patch to 4.2.2 Now
CVE-2026-32475 (CVSS 9.8) lets an unauthenticated attacker upload a PHP webshell through any Elementor Pro form. It’s being…
-
CVE-2026-48888: WooCommerce Core DoS — Update to 11.1.0 or Later
CVE-2026-48888 (CVSS 7.5) can exhaust server resources on any WooCommerce store running a version older than 11.1.0. The…
-
CVE-2026-19632: TranslatePress Account Takeover — Check Your Config Now
CVE-2026-19632 can leak an admin’s password-reset link through TranslatePress’s own translation table. Update to 3.3.4+ and check your…
-
CVE-2026-0740: Ninja Forms File Uploads RCE — Are You Still Exposed?
CVE-2026-0740 lets attackers upload a webshell to Ninja Forms File Uploads sites with no login. A March patch…
-
CVE-2026-18391: WooCommerce Subscriptions RCE — Check Your Version Now
WooCommerce Subscriptions has a critical CVSS 9.8 RCE vulnerability (CVE-2026-18391) affecting HPOS users. Update to 7.9.1, 8.8.2, or…
Ready to start your project?
Share your brief and we’ll propose the right approach — a full site, a landing page, or a custom plugin.