Events Manager Vulnerability: Subscriber SQL Injection
A serious Events Manager vulnerability allows authenticated WordPress users, including Subscribers, to reach a vulnerable SQL query through REST API…
WordPress plugin security
Ultimate Member Vulnerabilities Put Private Data at Risk
Two Ultimate Member vulnerabilities can expose privacy-restricted profile fields and place administrator sessions at risk through stored XSS. Site owners…
All in One SEO Vulnerability: Update to 5.0.2.1
A newly disclosed All in One SEO vulnerability can allow unauthenticated visitors to trigger registered WordPress shortcodes through crafted search…
Guest Post Forms Expose WordPress Sites to Stored XSS
A vulnerability in Frontend Post Submission Manager Lite can expose WordPress sites using guest submission forms to stored DOM-based XSS….
Simply Schedule Appointments Vulnerability: LFI Risk
A newly disclosed Simply Schedule Appointments vulnerability can allow local file inclusion through the ssa_locale parameter. Although formally classified as…
Critical Paytium Vulnerability Enables Admin Creation
A critical Paytium vulnerability tracked as CVE-2026-18467 can allow unauthenticated attackers to create WordPress administrator accounts under specific payment-form conditions….
Critical JetFormBuilder Vulnerability Is Under Active Attack
A critical JetFormBuilder vulnerability can allow unauthenticated attackers to create WordPress administrator accounts through unsafe form validation. Site owners running…
Eventin Vulnerability Restores Admin Power to User ID 1
A high-severity Eventin vulnerability can give administrator-equivalent capabilities back to WordPress user ID 1 after the account has been demoted….
Really Simple Security Vulnerability Can Bypass Email 2FA
A Really Simple Security vulnerability can reset completed email two-factor authentication, potentially allowing an attacker who already knows a WordPress…
Critical The Events Calendar Vulnerabilities Demand Action
Two critical The Events Calendar vulnerabilities can expose WordPress websites to unauthenticated remote code execution. Site owners should update directly…