Gravity Forms Vulnerability Allows Arbitrary File Upload
A high-severity Gravity Forms vulnerability can allow unauthenticated arbitrary file uploads when public forms use multi-file upload fields. CVE-2026-19513 affects…
WordPress vulnerability
Two Forminator Vulnerabilities Put Public Forms at Risk
Two recently disclosed Forminator vulnerabilities affect Stripe Checkout payments and the Save and Continue feature. This practical security guide explains…
Critical WPLP Cookie Consent Vulnerability Under Attack
A critical WPLP Cookie Consent vulnerability allows unauthenticated attackers to upload arbitrary files to vulnerable WordPress websites. Site owners running…
Critical GiveWP Vulnerability Enables Unauthenticated RCE
A critical GiveWP vulnerability tracked as CVE-2026-82222 can allow unauthenticated attackers to reach remote code execution through unsafe PHP object…
wpForo SQL Injection Exposes WordPress Forum Databases
A high-severity wpForo vulnerability allows unauthenticated attackers to target WordPress databases through the referer parameter. Learn which wpForo versions are…
Critical WPMU DEV Dashboard Vulnerability Under Attack
A critical WPMU DEV Dashboard vulnerability can let unauthenticated attackers gain WordPress administrator access when Hub SSO is enabled. Learn…
Formidable Charts Vulnerability Exposes Server Files
A high-severity Formidable Charts vulnerability can allow unauthenticated attackers to read sensitive server files on certain WordPress installations. CVE-2026-15990 affects…
InfusedWoo Pro Vulnerability Exposes Administrator Password Reset Links
The reported InfusedWoo Pro vulnerability highlights a dangerous WordPress authorization mistake: treating an admin-area request as proof that a user…
Critical Contact Form 7 Upload Vulnerability Allows RCE
A critical Contact Form 7 upload vulnerability affects the popular Drag and Drop Multiple File Upload extension. Attackers may exploit…
PPWP PHP Object Injection: What WordPress Admins Should Know
A high-severity PPWP vulnerability affects older versions of the WordPress password protection plugin. CVE-2026-0551 allows authenticated Contributors to inject PHP…