Do Son A Critical (CVSS 9.8) RCE flaw in Sneeit Framework is actively exploited. The bug allows unauthenticated attackers to run arbitrary code via call_user_func and take over WordPress sites. Update to v8.4 immediately.
wordpress
A Critical (CVSS 9.0) flaw in W3 Total Cache (CVE-2025-9501) allows unauthenticated attackers to execute arbitrary PHP code via a crafted comment. 1M+ sites are at risk. Update to v2.8.13.
A Critical (CVSS 9.8) Auth Bypass in AI Engine is actively exploited. The flaw exposes the MCP bearer token via the REST API when No-Auth URL is enabled, allowing admin takeover.
A Critical (CVSS 9.8) LFI flaw (CVE-2025-12493) in ShopLentor (WooCommerce Builder) allows unauthenticated attackers to run arbitrary .php files and compromise 100K+ e-commerce sites.
A Critical (CVSS 9.8) Auth Bypass in the Jobmonster theme's check_login() function is actively exploited. The flaw allows unauthenticated attackers to gain admin access to job board sites.
A critical security vulnerability has been identified and is being actively exploited in the King Addons for...
Urgent patch for Post SMTP plugin. A CVSS 9.8 flaw lets unauthenticated attackers read email logs and steal password reset links to take over accounts.
Wordfence exposed a Magecart campaign using a rogue WooCommerce plugin to hide skimmer code in a fake PNG image. The malware uses an AJAX backdoor to maintain access and steal customer cards.
Urgent patch for WP Freeio plugin (v.< 1.2.22). Unauthenticated attackers can gain admin control instantly via a registration flaw. Update immediately to v.1.2.22.
LiteSpeed Cache for WordPress (LSCWP) versions 7.5.0.1 are vulnerable to a Reflected XSS flaw, exposing 7M sites to account takeover. Update to 7.6 now.
Wordfence warned of a massive RCE campaign (8.7M+ attacks) exploiting flaws in GutenKit/Hunk Companion plugins. Unauthenticated attackers can install malicious plugins via vulnerable REST API endpoints.
Wordfence warns a Critical (CVSS 9.8) flaw (CVE-2025-5947) in Service Finder Bookings is being actively exploited to bypass authentication and gain full admin access.
A Critical (CVSS 9.8) flaw (CVE-2025-6388) in the Spirit Framework WordPress plugin is being actively exploited, allowing unauthenticated attackers to hijack admin accounts.
Yoast SEO Premium has a stored XSS flaw (CVE-2025-11241) that allows Contributor+ users to inject malicious scripts into posts. All users are urged to upgrade to v26.0 immediately.
Two WordPress Core vulnerabilities (XSS and Info Exposure) affecting versions up to 6.8.2 were accidentally exposed before patches were ready.
Security researcher Puja Srivastava from Sucuri uncovered two malicious files designed to guarantee persistent attacker access by...
A critical 9.8-rated vulnerability in the popular "Database for Contact Form 7" plugin could let unauthenticated attackers delete files and gain full control of sites.
Kaspersky exposes Efimer, a new crypto-stealer using fake legal threats and malicious torrents from compromised WordPress sites to hijack wallets and brute-force other sites.
A critical PHP object injection flaw (CVE-2025-52709, CVSS 9.8) in Everest Forms allows RCE when an admin views form submissions on PHP versions below 7.1. Update to v3.2.3 immediately.
A critical RCE flaw (CVE-2025-5394, CVSS 9.8) in the Alone WordPress theme allows unauthenticated attackers to upload arbitrary files and gain full site control. Exploitation is confirmed in the wild.
A supply chain attack injected backdoor malware into Gravity Forms plugin downloads from the official website. The backdoor allows RCE and creates admin accounts.
A critical flaw (CVE-2025-6691, CVSS 8.8) in the SureForms WordPress plugin allows unauthenticated arbitrary file deletion (e.g., wp-config.php), leading to full site takeover.