Eventin Vulnerability Restores Admin Power to User ID 1
A high-severity Eventin vulnerability can give administrator-equivalent capabilities back to WordPress user ID 1 after the account has been demoted….
WordPress vulnerability
MotoPress Hotel Booking Stripe XSS Vulnerability
A MotoPress Hotel Booking vulnerability can expose premium installations using Stripe to stored XSS when webhook signature verification is not…
Critical WooCommerce Wholesale Lead Capture Vulnerability
A critical WooCommerce Wholesale Lead Capture vulnerability is being actively exploited to upload dangerous files to WordPress servers. Store owners…
Really Simple Security Vulnerability Can Bypass Email 2FA
A Really Simple Security vulnerability can reset completed email two-factor authentication, potentially allowing an attacker who already knows a WordPress…
Critical The Events Calendar Vulnerabilities Demand Action
Two critical The Events Calendar vulnerabilities can expose WordPress websites to unauthenticated remote code execution. Site owners should update directly…
Unlimited Elements Vulnerability: Critical SQL Injection
A critical Unlimited Elements vulnerability allows unauthenticated attackers to target the WordPress database through SQL injection. Sites using affected Unlimited…
Kirki XSS: Why Updating Directly to 6.3.0 Is Recommended
A Kirki vulnerability affects versions 6.2.1 through 6.2.5 and can allow unauthenticated attackers to store JavaScript that executes when affected…
UsersWP Vulnerability Lets Sub Delete WP Files
A high-severity UsersWP vulnerability can allow authenticated Subscriber-level users to delete files from a WordPress server. CVE-2026-19991 affects UsersWP through…
Event Tickets Vulnerability Can Redirect Stripe Payments
A high-severity Event Tickets vulnerability can let unauthenticated attackers replace Stripe merchant credentials and redirect future ticket payments. WordPress event…
MStore API Vulnerability Allows Firebase JWT Forgery
A serious MStore API vulnerability can allow attackers to forge Firebase authentication tokens and impersonate WordPress users. The flaw highlights…