Do Son An active WordPress XSS campaign exploits Ninja Forms flaw CVE-2026-94504 and CVE-2026-93836 to plant hidden admin accounts. Patch now.
WooCommerce
Attackers are actively exploiting a critical WooCommerce Wholesale Lead Capture vulnerability. Patch WooCommerce Wholesale Lead Capture now.
A WooCommerce payment skimmer mimics Stripe to steal card data during real checkouts. Inside this Magecart-style attack and how merchants can fight back.
New Magecart campaign mimics Stripe forms to skim credit cards. Malware hides from admins & tricks users with fake errors. Active since 2022.
A Critical (CVSS 9.8) LFI flaw (CVE-2025-12493) in ShopLentor (WooCommerce Builder) allows unauthenticated attackers to run arbitrary .php files and compromise 100K+ e-commerce sites.
Wordfence exposed a Magecart campaign using a rogue WooCommerce plugin to hide skimmer code in a fake PNG image. The malware uses an AJAX backdoor to maintain access and steal customer cards.
A critical 9.8 CVSS vulnerability in PayU CommercePro for WordPress allows unauthenticated admin account takeover. No patch available, immediate removal advised.
Critical (CVSS 10) unpatched flaw in TI WooCommerce Wishlist allows unauthenticated RCE via file upload. Affects 100K+ sites.
A new, deeply stealthy formjacking malware is targeting WooCommerce, secretly stealing customer payment data from legitimate checkout processes.
A new phishing campaign targets WooCommerce users with fake security alerts. Learn how attackers use IDN homographs and malicious plugins to compromise stores.
Discover the rise of carding attacks with the malicious Python package disgrasya targeting WooCommerce stores with automated scripts.
CVE-2024-6457 leaves over 100,000 WooCommerce-powered online stores susceptible to unauthorized data breaches
attackers are leveraging an obscure WordPress plugin to install server-side malware, harvesting credit card details from WooCommerce online stores