Unlimited Elements Vulnerability: Critical SQL Injection
A critical Unlimited Elements vulnerability allows unauthenticated attackers to target the WordPress database through SQL injection. Sites using affected Unlimited…
WordPress plugin security
Kirki XSS: Why Updating Directly to 6.3.0 Is Recommended
A Kirki vulnerability affects versions 6.2.1 through 6.2.5 and can allow unauthenticated attackers to store JavaScript that executes when affected…
UsersWP Vulnerability Lets Sub Delete WP Files
A high-severity UsersWP vulnerability can allow authenticated Subscriber-level users to delete files from a WordPress server. CVE-2026-19991 affects UsersWP through…
Critical ComboBlocks Vulnerability Is Under Active Attack
A reported critical ComboBlocks vulnerability has raised urgent concerns for WordPress administrators. Learn what is currently known about the reported…
ACPT Vulnerability Allows Administrator Takeover
A critical ACPT vulnerability can allow unauthenticated attackers to modify existing WordPress user accounts through exposed public forms. Learn which…
Divi Ajax Filter Vulnerability Can Execute PHP Files
A critical Divi Ajax Filter vulnerability can allow unauthenticated attackers to include server-side PHP files when custom loop templates are…
Critical Super Forms Vulnerability Is Under Active Attack
A critical Super Forms vulnerability is being actively exploited against WordPress websites. CVE-2026-14894 allows unauthenticated arbitrary file uploads that can…
Critical WPLP Cookie Consent Vulnerability Under Attack
A critical WPLP Cookie Consent vulnerability allows unauthenticated attackers to upload arbitrary files to vulnerable WordPress websites. Site owners running…
Critical GiveWP Vulnerability Enables Unauthenticated RCE
A critical GiveWP vulnerability tracked as CVE-2026-82222 can allow unauthenticated attackers to reach remote code execution through unsafe PHP object…
Formidable Charts Vulnerability Exposes Server Files
A high-severity Formidable Charts vulnerability can allow unauthenticated attackers to read sensitive server files on certain WordPress installations. CVE-2026-15990 affects…