Do Son Urgent: Modular DS flaw CVE-2026-23550 (CVSS 10) is actively exploited in the wild. Attackers are creating fake admins. Update to the latest version now.
Patchstack
A supply chain attack injected backdoor malware into Gravity Forms plugin downloads from the official website. The backdoor allows RCE and creates admin accounts.
Over 10,000 WordPress sites at risk from Eventin plugin flaw CVE-2025-47539. Attackers can gain admin access via unauthenticated API exploit.
A new phishing campaign targets WooCommerce users with fake security alerts. Learn how attackers use IDN homographs and malicious plugins to compromise stores.
A critical vulnerability (CVE-2025-30911) in the RomethemeKit For Elementor WordPress plugin allows authenticated users to achieve RCE.