Vulnerabilities
Snazzy Social Media Feed Plugin Flaw Enables Remote Code Execution
A critical vulnerability in the Snazzy Social Media Feed plugin allows low-privilege users to upload executable files and run arbitrary code on WordPress sites.
WordPress
Everything SecOps Signal has reported about WordPress: 9 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
WordPress flaws disclosed Sept 28-Oct 4 2026: Wordfence urges site owners to review vulnerabilities
Wordfence Intelligence published its weekly vulnerability report for late September 2026, urging site owners to review disclosures to protect their platforms.
Vulnerabilities
Partiso Theme Deserialization Flaw: CVSS 9.8 Threat for Versions Up to 1.1.13
Sites running ThemeREX Partiso versions up to 1.1.13 face a CVSS 9.8 risk from untrusted data deserialization attacks.
Vulnerabilities
Greeny WordPress Theme Deserialization Flaw CVE-2026-93940 Puts V2.10.0 Sites at Critical Risk
A critical object injection vulnerability in the Greeny WordPress theme affects versions through 2.10.0, posing severe risks to unpatched sites.
Vulnerabilities
Hogwords Deserialization Flaw: CVSS 9.8 CVE-2026-93938 Affects Versions Up to 1.2.7
A CVSS 9.8 deserialization flaw in Hogwords versions up to 1.2.7 allows object injection, exposing sites to severe remote compromise risks.
Vulnerabilities
Gutentype Plugin Deserialization CVE-2026-62046 Scores 9.8 CVSS Through v2.1.12
The National Vulnerability Database rates CVE-2026-62046 as critical, affecting all Gutentype plugin versions up to 2.1.12 with untrusted data deserialization risks.
Vulnerabilities
Booklovers WP Theme Deserialization Bug Lets Attackers Inject Objects Remotely in Versions Up to 2.13.0
An unauthenticated object injection vulnerability in the Booklovers WordPress theme allows remote attackers to exploit deserialization flaws in versions up to 2.13.0.
Vulnerabilities
Avada Builder Arbitrary Hook Vuln Risks Permanent Content Loss via CVE-2026-97670
Unauthenticated attackers can trigger arbitrary WordPress hooks via Avada Builder forms, risking permanent content deletion and site disruption through CVE-2026-97670.
Vulnerabilities
PPOM Plugin Path Traversal Bug Lets Attackers Delete Files and Run Code on WordPress Sites
A critical flaw in the PPOM plugin for WordPress lets attackers delete server files and execute code without logging in, affecting versions up to 34.0.10.