Browsing Tag
Wordpress
73 posts
2 Critical Calendar WordPress Plugin Flaws Put 600K Sites at Risk of Takeover
Two critical RCE flaws in The Events Calendar expose 600,000+ WordPress installations to unauthenticated attacks, with CVSS scores of 9.8.
Server Mistake Exposes StopAndProtect’s Hacked WordPress Network
StopAndProtect used nearly 2,000 hacked WordPress sites to spread malware, steal files and deploy ransomware before an open server exposed its global operation.
500+ WordPress Sites Hacked to Push Infostealer via ClickFix Attack
Over 500 hacked WordPress sites use fake Cloudflare ClickFix prompts and the Deno runtime to infect Windows PCs with data-stealing malware.
XSS2Shell Vulnerability Puts 500 Million WordPress Sites at Risk of RCE
The XSS2Shell bug in WordPress could turn a failed login into server code execution after an attacker tricks a logged-in administrator; update to version 7.0.3.
New WordPress Malware Uses Steam Profile Comments to Hide C2 Instructions
GoDaddy researchers found WordPress malware using Steam Community profile comments to hide encoded command and control data, with nearly 1,980 sites affected.
Cloudflare Targets WordPress With New AI-Powered EmDash CMS
Cloudflare launches EmDash CMS, an AI-powered platform built to fix WordPress security flaws with sandboxed plugins, serverless scaling, and passkey auth.
ImageMagick Zero-Day Enables RCE on Linux and WordPress Servers
New research from Octagon Networks reveals a critical zero-day ImageMagick vulnerability that allows Remote Code Execution (RCE) via simple image uploads affecting Ubuntu, Amazon Linux, and WordPress. This magic byte shift bypasses even the most secure policies.
SQL Injection Vulnerability in Ally WordPress Plugin Exposes 200K+ Sites
SQL injection flaw in Ally WordPress plugin exposes 200,000+ sites to data theft. Patch released, but most installations remain unpatched and vulnerable.
Mass Attack Targets WordPress via GutenKit and Hunk Companion Plugins
Mass exploitation attacks are once again targeting WordPress websites, this time through serious vulnerabilities in two popular plugins,…
Auth Bypass Flaw in Service Finder WordPress Plugin Under Active Exploit
An Authentication Bypass (CVE-2025-5947) in Service Finder Bookings plugin allows any unauthenticated attacker to log in as an administrator. Over 13,800 exploit attempts detected. Update to v6.1 immediately.