Introduction A critical vulnerability in Kirki (Freeform Page Builder, Website Builder & Customizer), tracked as CVE-2026-8206 with a CVSS score o...
miniOrange Social Login and Register: Privilege Escalation (CVSS 9.8)
Introduction miniOrange Social Login and Register — a separate plugin from the same vendor’s OAuth SSO product — had a critical priv...
WP Ultimate CSV Importer: Maximum-Severity RCE (CVSS 10.0)
Introduction WP Ultimate CSV Importer had a remote code execution vulnerability disclosed with a maximum CVSS score of 10.0 — the highest possib...
WP Activity Log: Unauthenticated PHP Object Injection (300,000+ Sites Affected)
Introduction WP Activity Log, installed on more than 300,000 WordPress sites, had a high-severity unauthenticated PHP Object Injection vulnerability d...
Support Board Plugin: Unauthenticated Privilege Escalation (CVSS 9.8)
Introduction Support Board, a popular live chat and helpdesk plugin, had a critical unauthenticated privilege escalation vulnerability disclosed on Ju...
miniOrange OAuth Single Sign-On: Critical Authentication Bypass (CVE-2026-57807)
Introduction A critical authentication bypass vulnerability, CVE-2026-57807, was disclosed on July 9, 2026 in the miniOrange OAuth Single Sign-On plug...
Critical WordPress Core Vulnerability (wp2shell): Update Now, But Back Up First
Introduction A critical, unauthenticated remote code execution vulnerability — nicknamed wp2shell — is actively being exploited across Wor...