Do Son Three LiteSpeed Cache vulnerabilities, including stored XSS flaws CVE-2026-113499 and CVE-2026-113500, affect 7M+ WordPress sites. Update to 7.9.2.
WordPress Plugin
CVE-2026-18051 (CVSS 10) is an unauthenticated arbitrary file write in W3 Total Cache, exposing 900k+ WordPress sites. Update to 2.10.5.
A Ninja Forms vulnerability chain hits 600K+ sites. CVE-2026-65048 is an unauthenticated stored XSS rated CVSS 9.3. Update to 3.14.10 now.
Yoast SEO Premium has a stored XSS flaw (CVE-2025-11241) that allows Contributor+ users to inject malicious scripts into posts. All users are urged to upgrade to v26.0 immediately.
Learn about CVE-2025-0366, a serious vulnerability in the Jupiter X Core plugin that allows remote code execution.
Beware of PhishWP: a dangerous WordPress plugin that disguises itself as a legitimate tool but actually steals your sensitive information.
This vulnerability, designated as CVE-2024-4295, carries a severity rating of 9.8 (CVSS), making it a prime target for exploitation
Identified as CVE-2024-2194 with a CVSS score of 7.2, this vulnerability is classified as a stored cross-site scripting (XSS) issue
A critical SQL injection vulnerability (CVE-2024-1698) was discovered in the widely used NotificationX WordPress plugin
CVE-2024-0221 (CVSS 9.1) is a directory traversal vulnerability threatened to mar the integrity of the Photo Gallery plugin
Automattic has recently alerted its user base to a critical security vulnerability in the Jetpack WordPress Plugin — CVE-2023-2996