WPDeeply
Download free plugin

Security Research

Historical and current WordPress vulnerability disclosures.

60
Guides
All 109 Plugin Security 64 Security Research 60 Vulnerability Types 11 Hardening 10 Security News 7 Malware 5 WordPress Insights 4 RSS
ShopMagic up to 4.9.0 – Unauthenticated Local File Inclusion (CVE-2026-103367) ShopMagic versions through 4.9.0 contain a high-severity local file inclusion vulnerability that can allow an unauthenticated attacker to include and execute a PHP file already present on the… Plugin Security 14 Oct 2026, 3 min SimpleForm up to 3.10.0 – Unauthenticated Administrator Account Creation (CVE-2026-104748) SimpleForm versions through 3.10.0 contain a critical unauthenticated privilege-escalation vulnerability that can let a remote attacker create a WordPress user with Administrator capabilities. Wordfence assigned CVE-2026-104748 a CVSS… Plugin Security 14 Oct 2026, 3 min Divi Plus up to 2.4.0 – Unauthenticated Arbitrary File Read (CVE-2026-91136) CVE-2026-91136 lets unauthenticated attackers read server files through a Divi Plus REST endpoint. Update to version 2.4.1 immediately. Plugin Security 13 Oct 2026, 3 min Ghostscript 9.21-10.07.1 – Unauthenticated RCE Risk via WordPress PDF Previews (CVE-2026-39919) CVE-2026-39919 can turn WordPress PDF preview processing into build-specific remote code execution on servers using vulnerable Ghostscript packages. Plugin Security 13 Oct 2026, 4 min Extensions For CF7 <= 3.4.5 - Unauthenticated Arbitrary File Upload to RCE (CVE-2026-94589) CVE-2026-94589 is a critical unauthenticated file-upload flaw in Extensions For CF7 3.4.5 and earlier. Update to 3.4.6 immediately. Plugin Security 12 Oct 2026, 3 min Avada Builder <= 3.16.1 - Unauthenticated Arbitrary WordPress Action Invocation (CVE-2026-97670) CVE-2026-97670 lets unauthenticated attackers invoke WordPress action hooks through Avada Forms. Update Avada to 7.16.2 and Avada Builder to 3.16.2. Plugin Security 12 Oct 2026, 3 min Doctreat <= 1.7.0 and Doctreat Core <= 1.7.0 - Unauthenticated File Upload and Privilege Escalation Two critical unauthenticated flaws affect Doctreat through version 1.7.0: arbitrary file upload in the theme and privilege escalation in Doctreat Core. Plugin Security 10 Oct 2026, 4 min Bricksforge ≤ 3.1.8.9 – Actively Exploited Unauthenticated File Upload to RCE CVE-2026-85097 is an actively exploited, unauthenticated arbitrary file upload vulnerability in Bricksforge 3.1.8.9 and earlier. Update to 3.1.8.10 or later immediately. Plugin Security 9 Oct 2026, 4 min Kirki ≤ 6.3.1 – Unauthenticated Stored XSS via Registration Metadata Kirki 6.3.1 and earlier are vulnerable to unauthenticated stored XSS via registration metadata. Update to 6.3.2 and review exposed registration workflows. Plugin Security 8 Oct 2026, 3 min Active WordPress XSS Campaign – Hidden Admin Persistence via Ninja Forms and WPC Product Bundles Attackers are exploiting stored XSS flaws in Ninja Forms and WPC Product Bundles to install a fake WP Smart Thumbnails plugin, hide an administrator account, and add persistent… Plugin Security 7 Oct 2026, 4 min