24855 matches found
How a Webmail Log File Became a Root-Level Backdoor
THREAT ANALYSIS May 2026 · Forensic Case Study A forensic breakdown of how an attacker turned CyberPanel's SnappyMail logging into a persistent webshell that survived every WordPress cleanup attempt. A WordPress site owner reported redirect malware on their site. They found that clicking anywhere...
CVE-2026-27424
Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.11...
EUVD-2026-31072
SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters 'modelname', 'modelid', 'integrationid', 'provider' on the REST API endpoint '/surecart/v1/integrations/id'. The root cause is a flawed escaping bypass in the query builder 'wp-query-builder'...
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fixed handling of PTE markers in hugetlbchangeprotection The patch series “mm/hugetlb: uffd-wp fixes for hugetlbchangeprotection”. While testing virtio-mem and background snapshots using uffd-wp on hugetlb in QEMU, I...
EUVD-2026-31030
The Read More & Accordion plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.5.7. This is due to the 'RadMoreAjax::importData' function not restricting which database tables can be written to during import and not properly validating the imported...
CVE-2026-45444: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a through 4.2.6...
CVE-2026-9065: Improper Neutralization of Special Elements used in an SQL Command
SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters 'modelname', 'modelid', 'integrationid', 'provider' on the REST API endpoint '/surecart/v1/integrations/id'. The root cause is a flawed escaping bypass in the query builder 'wp-query-builder'...
WordPress plugin VatanSMS WP SMS has a cross-site scripting vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
WordPress plugin ProSolution WP Client code-related vulnerabilities
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There we...
CVE-2026-6555: Unrestricted Upload of File with Dangerous Type
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and...
PT-2026-42226
Name of the Vulnerable Software and Affected Versions Gift Cards For WooCommerce Pro versions prior to 4.2.7 Description An unrestricted file upload issue allows the use of malicious files with dangerous types. This flaw has been confirmed to be exploited in the wild. Recommendations Update to a...
CVE-2026-7462: Improper Neutralization of Input During Web Page Generation
The VatanSMS WP SMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 1.01. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
CVE-2026-8610: Missing Authorization
The TypeSquare Webfonts for ConoHa plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
CVE-2026-27424: Missing Authorization
Missing Authorization vulnerability in WP Chill Image Photo Gallery Final Tiles Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.11...
CVE-2026-8626: Improper Neutralization of Input During Web Page Generation
The SponsorMe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHPSELF Parameter in all versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2026-6381 WP Maps < 4.9.3 - Subscriber+ Local File Inclusion
The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks...
CVE-2026-6381
The WP Maps WordPress plugin (versions prior to 4.9.3 ) is vulnerable to a Local File Inclusion (LFI) attack. The root cause is the improper sanitization of a parameter used in a file path, which allows authenticated users to perform LFI. This vulnerability is also described as a path traversal i...
CVE-2026-6379
The WP Photo Album Plus WordPress plugin (versions prior to 9.1.11.001 ) is vulnerable to unauthenticated SQL injection due to improper sanitization of the wppa-supersearch parameter. The wppa_get_photos() function parses this parameter as a CSV, and when the type is set to o (Owner), the DATA co...
CVE-2026-6381 WP Maps < 4.9.3 - Subscriber+ Local File Inclusion
The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks...
