The Checkout Files Upload for WooCommerce WordPress plugin versions before 2.4.1 contains a vulnerability where it does not properly verify that uploaded files at checkout are allowed image types. This flaw allows unauthenticated users to upload HTML files disguised as images, which can execute JavaScript in the browser of a shop manager or administrator viewing the order screen. This issue is a regression of a previously fixed vulnerability (CVE-2025-4212) and was reintroduced in version 2.4.0.
The Swipe WordPress plugin versions through 1.4 contain a vulnerability where login requests are not properly authenticated before issuing WordPress session cookies. This flaw allows unauthenticated attackers to log in as any existing user, including administrators, if that user has an active app session.
The Duplicate Post WordPress plugin versions before 1.5.8 have a vulnerability where the plugin does not verify if a user has permission to publish posts when duplicating them. This flaw allows users with roles granted access to the plugin, such as Contributors, to create published posts, including posts attributed to other users.
The WP Ultimate CSV Importer WordPress plugin versions before 9.3 contain a vulnerability where values from imported files are not escaped before use in SQL queries when importing LifterLMS content. This flaw allows high privilege users, such as administrators on single or multisite WordPress installations, to perform SQL injection attacks.
The Countdown, Coming Soon, Maintenance WordPress plugin versions through 3.0.8 have an authorization bypass vulnerability in one of its AJAX actions. This flaw allows any authenticated user, including low-privileged roles like subscribers, to retrieve the titles of published posts of any post type, even those normally hidden from them. However, draft, private, and pending posts are not disclosed.
The Countdown, Coming Soon, Maintenance WordPress plugin versions up to 3.0.8 lack authorization and nonce checks when saving countdown data. This flaw allows users with Author-level access or higher to inject arbitrary web scripts due to insufficient output sanitization that permits script tags. These scripts execute when the affected content is viewed on the front end or by administrators.
The Email Marketing 4Dem WordPress plugin versions up to 2.0.5 lack authorization and capability checks on multiple AJAX actions. This flaw allows unauthenticated users to delete stored configurations and records within the plugin.
The Email Marketing 4Dem WordPress plugin versions up to 2.0.5 lack authorization and capability checks on multiple AJAX actions and REST routes. This flaw allows unauthenticated users to access and disclose stored plugin configuration and data, as well as modify the plugin's stored settings.
A nationwide FAA ground stop occurred due to a communications problem at air route traffic control centers, likely caused by a software update overwhelming legacy equipment. Officials, including Homeland Security and the FBI, found no evidence of a cyberattack. The outage lasted over four hours and disrupted thousands of flights, with delays expected to continue. The FAA was applying patches and installing new technology, which may have triggered the failure. No official root cause has been announced, and investigations continue.
The Flatsome WordPress theme up to version 3.20.12 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with contributor-level access or higher can inject malicious scripts via certain HTML attributes ('data-text-sec', 'data-title', and 'title') in Custom HTML blocks. The vulnerability arises because the theme does not properly sanitize or escape these attributes, and WordPress's wp_kses_post function permits data-* attributes globally, allowing the malicious payload to persist and execute in users' browsers when they visit affected pages.
The npm package @sfunction/dsh-screenshot version 0.1.1 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, secure machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
A malicious actor sent a job offer containing a ZIP archive with a Git repository specially crafted to execute malicious code automatically. The repository included a .git directory with a custom hooksPath redirecting Git hooks to an obscure location and a Git filter configured to run a script whenever git status or branch switching commands are executed. This script downloads and executes code from a remote server without requiring explicit user action beyond normal Git commands. The attack leverages legitimate Git features (hooks and filters) to trigger code execution stealthily.
The trezortranslate package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
CVE-2026-129181 is a SQL injection vulnerability in projectworlds Visitor Management System version 1.0. The flaw exists in the mysqli_query function within the /img/user page.php file at the Login Endpoint, where manipulation of the Username parameter allows injection. This vulnerability can be exploited remotely and public exploit code is available. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
CVE-2026-129319 is a high-severity vulnerability in the create-ecdh library (versions before 4.0.5) used by browserify. The flaw involves improper input validation of peer public keys in the ECDH key agreement process, allowing attackers to submit crafted keys that can lead to private key recovery or predictable shared secrets. This issue affects the JavaScript implementation used on Node.js versions lacking native crypto.createECDH support. The vulnerability is fixed in version 4.0.5.
The Optimole WordPress plugin up to version 4.2.19 contains a vulnerability that allows unauthenticated attackers to delete arbitrary files on the server due to insufficient file path validation. Exploitation requires the presence of PEAR's Archive_Tar library and an administrator to perform a rename action on an attachment after the attacker stages a malicious payload. This can lead to remote code execution if critical files like wp-config.php are deleted. The vulnerability has a high severity score of 7.1 and requires user interaction by an administrator to be exploited.
The AutomatorWP Pro plugin for WordPress' webhook addon contains an authorization bypass vulnerability in all versions up to and including 1.4.4. This flaw allows unauthenticated attackers to reset the password of any WordPress account, including administrators, leading to full account takeover. Exploitation requires a specific plugin configuration involving a Receive Webhook trigger paired with an Update-User action with certain fields set as described in the advisory.
The Quick Page/Post Redirect Plugin for WordPress versions 5.2.1 through before 5.2.4 contained a hidden update mechanism that fetched updates from a malicious server controlled by the plugin author instead of the official WordPress.org repository. This mechanism was exploited in March 2021 to deliver a backdoored plugin build (version 5.2.3) that injected arbitrary content into pages and delivered arbitrary code, primarily serving SEO spam links to visitors and search engine crawlers. The plugin was fixed in version 5.2.4, which restored the official update channel and removed the backdoor.