Kirki CVE-2026-8206
Kirki 6.0.0 through 6.0.6 can let unauthenticated attackers route password reset links…
WP Maps Pro CVE-2026-8732
WP Maps Pro CVE-2026-8732 lets unauthenticated attackers create WordPress administrator accounts. Update…
Avada Builder CVEs Put WordPress Sites at File Read and SQLi Risk
Avada Builder patched two WordPress vulnerabilities that could expose server files or…
FunnelKit Checkout Skimmer Hits WooCommerce Payment Pages
Attackers are abusing vulnerable FunnelKit/Funnel Builder installations to inject checkout skimmers into…
Burst Statistics CVE-2026-8181 Exploited for WordPress Admin Takeover
Attackers are exploiting CVE-2026-8181 in the Burst Statistics WordPress plugin. Update to…
ClickFix WordPress Attacks Push Vidar Stealer Malware
Australia warns that ClickFix attacks are abusing compromised WordPress sites and fake…
GoDaddy ManageWP Phishing Ads Target WordPress Admins
A paid-search phishing campaign is targeting GoDaddy ManageWP logins, turning one stolen…
WordPress Ad-Fraud Plugins and the Scallywag Operation
Cybersecurity researchers have found a large-scale ad fraud scheme called "Scallywag". It…
Critical RCE Vulnerability in GiveWP WordPress Plugin
A critical vulnerability has been discovered in the GiveWP WordPress plugin that…
WordPress Critical Vulnerability Fixed in Patch 6.4.2
WordPress has rolled out version 6.4.2, addressing a critical remote code execution…
Phishing With Hacked Sites Becomes a Massive Menace
Threat actors started using compromised websites for phishing purposes much more frequently.…