CMS Security

WordPress 7.1.3 Security Update Fixes Stored XSS, SQL Injection and Five More Flaws

• Vulnerability Report

WordPress 7.1.3 Security Update Fixes Stored XSS, SQL Injection and Five More Flaws

Do Son October 6, 2026 0

The WordPress 7.1.3 security update is a WordPress security release that fixes stored XSS, SQL injection and more. Update your site now.

WordPress 7.1.1 Fixes 11 Security Flaws, Update Now

• Vulnerability Report

WordPress 7.1.1 Fixes 11 Security Flaws, Update Now

Do Son September 18, 2026 0

The WordPress 7.1.1 security release fixes 11 flaws, including stored cross-site scripting and path traversal. Update your sites immediately.

CVE-2026-77806: SPIP Unauthenticated RCE Exploited in the Wild as Public Exploit Lands

• Vulnerability Report

CVE-2026-77806: SPIP Unauthenticated RCE Exploited in the Wild as Public Exploit Lands

Do Son August 21, 2026 0

CVE-2026-77806 (CVSS 9.8) is a SPIP unauthenticated RCE exploited in the wild, with public exploit code now available. Update to SPIP 4.4.21 now.

CVE-2026-77647 (CVSS 9.8): Unauthenticated SPIP RCE Exploited in the Wild

• Vulnerability Report

CVE-2026-77647 (CVSS 9.8): Unauthenticated SPIP RCE Exploited in the Wild

Do Son August 21, 2026 0

CVE-2026-77647 (CVSS 9.8) is an unauthenticated SPIP remote code execution flaw exploited in the wild. Update to SPIP 4.4.20 now.

CVE-2026-64638: WordPress Pre-Auth XSS Flaw Can Escalate to Remote Code Execution

• Vulnerability Report

CVE-2026-64638: WordPress Pre-Auth XSS Flaw Can Escalate to Remote Code Execution

Do Son August 7, 2026 0

WordPress 7.0.3 fixes CVE-2026-64638, a pre-auth XSS on the login screen that can escalate to remote code execution. CVSS 8.9. Update now.

Plone Fixes Critical RCE Flaw and Two Denial-of-Service Bugs

• Vulnerability Report

Plone Fixes Critical RCE Flaw and Two Denial-of-Service Bugs

Do Son July 1, 2026 0

A critical Plone RCE vulnerability (CVE-2026-57149, CVSS 9.9) allows TALES injection via the Classic portlet. Two more flaws enable DoS and SSRF.

Total CMS Takeover: Movable Type Patches Critical 9.8 CVSS Perl RCE

• Vulnerability Report

Total CMS Takeover: Movable Type Patches Critical 9.8 CVSS Perl RCE

Do Son April 13, 2026 0

Movable Type patches a critical 9.8 CVSS RCE vulnerability in its Listing Framework. Secure your CMS against Perl code execution and SQLi—update today!

Winter CMS Urgently Patches Critical 10.0 CVSS Privilege Escalation Flaw

• Vulnerability Report

Winter CMS Urgently Patches Critical 10.0 CVSS Privilege Escalation Flaw

Do Son March 13, 2026 0

Winter CMS urgently patches a critical 10.0 CVSS privilege escalation flaw (CVE-2026-27591) allowing low-level backend users to gain full system control.

The ‘Must-Patch’ Release: WordPress 6.9.2 Scrambles to Fix 10 Critical Flaws from XSS to SSRF

• Vulnerability Report

The ‘Must-Patch’ Release: WordPress 6.9.2 Scrambles to Fix 10 Critical Flaws from XSS to SSRF

Do Son March 11, 2026 0

Urgent: WordPress 6.9.2 patches 10 critical security flaws, including XSS, SSRF, and path traversal. Update your site immediately to prevent exploitation.