The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress contains a SQL Injection vulnerability in the 'src_by' parameter affecting all versions up to and including 3.5.1. This vulnerability allows unauthenticated attackers or authenticated users with any POS role to inject malicious SQL commands via the /vitepos/v1/vendor/list REST route, potentially exposing sensitive database information. The vulnerability arises from insufficient escaping and lack of proper query preparation. The CVSS 3.1 score is 7.5 (high severity), indicating a network exploitable flaw with no privileges or user interaction required and high confidentiality impact. No patch information is provided, and no known exploits are reported in the wild.
The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the affected comment to appear on a post that loads the surecart-components runtime (e.g. via a [sc_buy_button] shortcode) and contains no sc-checkout element, as these conditions trigger the innerHTML sink in sc-cart-loader.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Legal Consent record exists for the attacker's user account, causing the View Logs button to appear in the wp-admin/users.php Consent Logs column.
The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the store_upload function. This is due to a fail-open extension allow-list in extension_is_allowed() that returns true when wp_check_filetype() yields an empty type for unrecognized extensions such as .php, combined with magic-byte-only MIME detection and no capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. Exploitation requires the Helpdesk module to be enabled, as the vulnerable REST endpoint is only registered when that module is active.
Microsoft released patches addressing over 30 vulnerabilities, including two dozen high-severity remote code execution (RCE) flaws in the Office suite. The vulnerabilities include buffer overflows, off-by-one, use-after-free, path traversal, and numeric truncation errors. Most RCEs require a user to open a specially crafted file, such as a malicious document. The majority of fixes target Word, with some for Excel, Outlook, PowerPoint, and SharePoint. Additional fixes cover information disclosure and security bypass issues in Office, as well as other Microsoft products. No exploitation in the wild has been reported for these vulnerabilities.
The GhostAction campaign is a supply chain attack targeting GitHub developer accounts and repositories. It compromises user accounts to inject malicious GitHub Actions workflows that steal CI/CD secrets, cloud credentials, and API keys. The campaign has affected about 1,900 GitHub accounts and over 30,000 repositories as of October 2026. GitHub has intervened to prevent the malicious workflows from running in recent waves of the attack.
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML.
The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 7-day review-nag timer has elapsed since the attacker's first wp-admin visit, as the nonce needed to reach the save-network handler is only rendered in the DOM once that timer has passed.
The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site owner has previously completed the standard Freemius opt-in flow; once that condition is met, any Subscriber can reach the vulnerable handler simply by loading /wp-admin/profile.php with the requisite query parameters.
The Vulnity Security plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 1.4.3. This flaw arises from improper protection of a delegated-login credential file on Nginx-based setups, where the plugin's server configuration snippet incorrectly guards the wrong directory path. Exploiting this allows unauthenticated attackers to access stored credentials, forge signed REST API requests, and gain administrator access.
The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is present only in the premium build of the plugin and is not present in the free WordPress.org distribution. The nonce required to call the vulnerable AJAX endpoint is localized into the page source of every front-end page for anonymous visitors, making it fully obtainable by unauthenticated attackers.
A cyberattack targeting government contractor BAE Systems disrupted the notice system used by US federal bankruptcy courts, impacting court operations.
Proofpoint, a cybersecurity company owned by Thoma Bravo, announced an all-cash acquisition of Varonis, a data and AI security firm, for approximately $6.3 billion. The transaction will make Varonis a private company and is expected to close in the first half of 2027. Both companies will continue to operate independently until the deal is finalized. Post-acquisition, Proofpoint plans to integrate Varonis's data and AI security capabilities into a unified platform. This acquisition is part of a broader trend of cybersecurity mergers and acquisitions in 2026.
CVE-2026-94169 is a critical code injection vulnerability in Theme-one The Grid versions prior to 2.8.2. It allows an attacker to perform command injection due to improper control of code generation. The vulnerability has a CVSS score of 10.0, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-94388 is a critical SQL Injection vulnerability in halfdata Green Popups that allows blind SQL injection attacks. It affects versions from 0 up to but not including 7.6.3. The vulnerability enables an attacker to execute unauthorized SQL commands, potentially leading to high confidentiality impact and partial denial of service. No official patch or remediation details are provided in the input data.
CVE-2026-97296 is a high-severity vulnerability in Rocketgenius, Inc Gravity Forms that involves deserialization of untrusted data, leading to object injection. This affects Gravity Forms versions from initial releases up to but not including 3.1.1. The vulnerability has a CVSS score of 8.1, indicating a significant risk to confidentiality, integrity, and availability if exploited.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.
CVE-2026-110366 is a missing authorization vulnerability in Gemini Labs Site Reviews affecting versions prior to 8.3.5. It allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized modification of site reviews. The vulnerability has a medium severity rating with a CVSS score of 5.3.