Do Son Cybereason exposes a deceptive malware campaign using compromised WordPress sites and the "ClickFix" technique to deliver weaponized NetSupport Manager RAT clients for remote access.
wordpress
Sucuri uncovers a stealthy WordPress malware plugin that mimics your domain to inject SEO spam for bots while remaining invisible to users, evading detection.
A critical flaw (CVE-2025-6463, CVSS 8.8) in Forminator WordPress plugin allows unauthenticated arbitrary file deletion, leading to site takeover.
Sucuri uncovers a complex multi-stage malware campaign infecting WordPress sites via header.php to deliver a hidden RAT (client32.exe) and evade detection.
A rogue WordPress plugin is distributing multi-functional malware, performing credit card skimming, credential theft, ad fraud, and RCE through advanced evasion tactics.
A critical flaw (CVE-2025-4322) in the WordPress Motors theme allows unauthenticated attackers to reset passwords for full site takeover.
A critical flaw (CVE-2025-5071) in WordPress's AI Engine plugin allows subscribers to escalate privileges and take over websites with Dev Tools/MCP enabled.
Infoblox unmasks VexTrio, a sprawling malicious adtech ecosystem intertwined with DNS-based malware campaigns and global website compromises, fueled by commercial operators
A critical privilege escalation flaw (CVE-2025-4601) in RealHomes WordPress theme allows low-privilege users to become admins. Update now!
A critical 9.8 CVSS vulnerability in PayU CommercePro for WordPress allows unauthenticated admin account takeover. No patch available, immediate removal advised.
A critical Auth0 PHP SDK deserialization flaw (CVE-2025-48951, CVSS 9.3) allows unauthenticated RCE in web apps. Patch to v8.14.0+ immediately!
Wordfence uncovers a sophisticated WordPress malware disguised as a legitimate plugin, stealing admin credentials & enabling remote code execution.
A malware campaign is hijacking WordPress sites with fake Java update pop-ups, tricking visitors into downloading malicious executables.
Critical (CVSS 10) unpatched flaw in TI WooCommerce Wishlist allows unauthenticated RCE via file upload. Affects 100K+ sites.
Malicious scripts disguised as Cloudflare human verification are embedded in WordPress themes, tricking users into executing PowerShell commands that deliver malware.
A new, deeply stealthy formjacking malware is targeting WooCommerce, secretly stealing customer payment data from legitimate checkout processes.
Critical vulnerability (CVSS 9.8) in the Motors WordPress theme! This flaw puts over 22,000 websites at risk of full takeover. Update now!
A WordPress vulnerability puts private information at risk for nearly a billion websites. Can your site's draft titles be stolen?
Over 10,000 WordPress sites at risk from Eventin plugin flaw CVE-2025-47539. Attackers can gain admin access via unauthenticated API exploit.
Two CVEs in TheGem WordPress theme let subscriber-level users upload malicious files and take over sites. Patch to version 5.10.3.1 now.
CVE-2025-3616 in Greenshift plugin allows subscriber-level users to upload malicious files, enabling remote code execution on 50,000+ WordPress sites.
A critical vulnerability (CVE-2025-30911) in the RomethemeKit For Elementor WordPress plugin allows authenticated users to achieve RCE.