Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 34 results
criticalbug_reportVulnerabilityRank Math PRO WordPress plugin compromised in supply-chain attack
Rank Math PRO version 3.0.123 downloaded from the official vendor website between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC (11-hour window). Free version of Rank Math SEO unaffected.
criticalbug_reportVulnerabilityNext.js patches two critical RCE flaws in caching and SVG processing
Next.js versions 10.0.0–15.5.27 and 16.0.0–16.4.0. Critical RCE in React Server Components (v16 with Cache Components enabled, use cache functions returning multiple typed arrays).
criticalbug_reportVulnerabilityDrupal Field UI RCE flaw patched; unauthenticated exploit path exists
Drupal core versions 10.6.x, 11.3.x, and 11.4.x with Field UI module enabled. Fixed in 10.6.19, 11.3.19, and 11.4.10. Drupal 8, 9, and older 10.x/11.x branches are end-of-life and unpatched.
criticalbug_reportVulnerabilityBricksforge WordPress plugin RCE exploited in wild (CVE-2026-85097)
Bricksforge WordPress plugin versions up to and including 3.1.8.9. Patched in version 3.1.8.10 (latest version 4.0.1 recommended). Affects WordPress sites using Bricksforge with Bricks visual builder.
highbug_reportVulnerabilityNinja Forms and WPC Product Bundles XSS flaws under active exploit
Ninja Forms plugin versions 3.15.3 and older (500,000+ sites); WPC Product Bundles for WooCommerce versions 8.6.6 and older (30,000+ sites). Tracked as CVE-2026-93836 and CVE-2026-94504. Both are authenticated stored XSS vulnerabilities.
highbug_reportVulnerabilityElementor WordPress plugin CSRF flaw enables admin account takeover via link
Elementor Website Builder WordPress plugin versions 4.3.0 and 4.3.1 only. Affects over 2 million active installations. Fixed in version 4.3.2.
highbug_reportVulnerabilityElementor WordPress plugin CSRF flaw enables admin account creation
Elementor plugin for WordPress. Specific affected versions not disclosed in available data. Impacts WordPress sites using the Elementor page builder plugin.
criticalbug_reportVulnerabilityWordPress RCE flaw CVE-2026-87902 exploited hours after disclosure
WordPress versions prior to 7.1.2 (also 7.0.6, 6.9.9, 6.8.10). Exploitation requires active theme with top-level directory starting with "page-" and readable local .php file (e.g., pearcmd.php) on server.
criticalbug_reportVulnerabilityWordPress path traversal flaw enables unauthenticated RCE on some servers
WordPress core versions 4.7.0 through 7.1.1. All installations are vulnerable to path traversal; remote code execution depends on active theme having a folder starting with "page-" and server configuration (register_argc_argv enabled, presence of exp…
highbug_reportVulnerabilityWordPress Core CSRF flaw (Click2Shell) enables RCE via theme preview
WordPress Core versions 7.1.0 and earlier. Fixed in version 7.1.1 released last week. Affects all WordPress installations running vulnerable versions where administrators can be socially engineered to click malicious links.
highbug_reportVulnerabilityWordPress Click2Shell flaw forces theme install via link, chains to RCE
WordPress core versions 6.0 through 7.1.0. Patched in WordPress 7.1.1 and backported security releases for all supported branches back to 4.7. Exploitation requires logged-in administrator to open crafted link.
highbug_reportVulnerabilityAdmin Menu Editor Pro supply chain attack backdoors 1,500 WordPress sites
Admin Menu Editor Pro WordPress plugin versions 2.35 and 2.36. At least 230 customers affected across approximately 1,500 WordPress sites. The free version (300,000+ installations) is not affected.
criticalbug_reportVulnerabilityActive RCE exploits target Super Forms and Elementor Pro WordPress plugins
WordPress plugins: Super Forms – Drag & Drop Form Builder (fixed in 6.3.314) and Elementor Pro (fixed in 4.2.2). CVE-2026-14894 affects all unauthenticated users; CVE-2026-32475 requires at least one published Elementor page with Form widget containi…
criticalbug_reportVulnerabilityElementor Pro CVE-2026-32475 actively exploited for webshell uploads
Elementor Pro plugin for WordPress versions 4.2.1 and earlier. Affects sites with published Elementor Pro Form widgets containing File Upload fields. Over 6 million active installations globally.
criticalbug_reportVulnerabilityCritical WordPress plugin flaws enable auth bypass and RCE on popular sites
WPMU DEV Dashboard plugin ≤5.0.1 (CVE-2026-76581), Avada theme ≤7.16 with Fusion Builder ≤3.16 (CVE-2026-18431), TranslatePress ≤3.3.1 with specific config (CVE-2026-19632), Pods plugin ≤3.3.9 (CVE-2026-19598), GiveWP plugin ≤4.16.7.1 (CVE-2026-82222…
criticalbug_reportVulnerabilityNext.js critical RCE flaws in AVIF processing and Windows path traversal
Next.js versions 13.4–15.5.23 and 16.0–16.3.2. CVE-2026-75604 (Windows path traversal, CVSS 9.0) affects Windows-hosted servers using Pages Router or App Router without Cache Components.
criticalbug_reportVulnerabilityAvada WordPress theme RCE chain affects sites with theme + plugin active
Avada WordPress theme versions up to 7.16 and Fusion Builder plugin versions up to 3.16. Exploitation requires both components to be active simultaneously.
criticalbug_reportVulnerabilityElementor Pro WordPress plugin allows arbitrary file upload and RCE
Elementor Pro WordPress plugin. Specific vulnerable versions not disclosed in available data. Affects WordPress sites with Elementor Pro installed.
criticalbug_reportVulnerabilityForminator WordPress plugin RCE affects 600K+ sites via file upload bypass
Forminator Forms WordPress plugin versions ≤1.56.1. Affects 600,000+ active installations. Exploitation requires a form with both File Upload and Select fields. Sites using custom file upload storage paths are at higher risk.
highbug_reportVulnerabilityWordPress pre-auth XSS on login page enables RCE via admin interaction
WordPress CMS all versions prior to 7.0.3. Patches backported to 4.7 branch and newer. Versions older than 4.7 remain vulnerable and unpatched. Default installations affected; no special hosting configuration required.
criticalbug_reportVulnerabilityTerraform MCP, Veeam VSPC, Django patch 11 flaws including CVSS 10.0 bug
HashiCorp Terraform MCP Server versions 0.2.1–1.0.0 (Streamable HTTP mode only); Veeam Service Provider Console versions 9.2.1.33875 and earlier (all version 9 builds before 9.3); Django versions prior to 6.0.8 and 5.2.17 (GeoDjango spatial field con…
criticalbug_reportVulnerabilityWordPress Core RCE flaws CVE-2026-63030, CVE-2026-60137 under active exploit
WordPress Core (specific versions not disclosed in advisory). Two remote code execution vulnerabilities (CVE-2026-63030, CVE-2026-60137) affecting the core platform.
criticalbug_reportVulnerabilityWordPress Core RCE "wp2shell" exploits now public, patch immediately
WordPress Core (specific versions not disclosed in provided data). Vulnerability enables remote code execution. Public exploits available under the name "wp2shell".
criticalbug_reportVulnerabilityWordPress 6.9–7.0 unauthenticated RCE patched, forced auto-update active
WordPress core versions 6.9.0–6.9.4 and 7.0.0–7.0.1. All sites running these versions are vulnerable to unauthenticated remote code execution via anonymous HTTP requests. Patched in 6.9.5 and 7.0.2.
highbug_reportVulnerabilityShapedPlugin WordPress Pro plugins backdoored via compromised update channel
Multiple ShapedPlugin Pro WordPress plugins distributed through official licensed update channels. Exact plugin names and affected versions not specified.
highbug_reportVulnerabilityShapedPlugin WordPress plugins compromised in supply chain attack
Multiple WordPress plugins from ShapedPlugin vendor. Infected releases distributed to paying customers via official update mechanism. Specific plugin names and version numbers not disclosed in provided data.
criticalbug_reportVulnerabilityCritical vulnerability in Joomla Content Editor (JCE) requires urgent patching
Joomla Content Editor (JCE) extension for Joomla CMS. Specific affected versions not disclosed in advisory. All Joomla sites using the JCE extension should be considered at risk pending vendor confirmation.
highbug_reportVulnerabilityAwesome Motive CDN breach compromises WordPress plugins in supply-chain attack
WordPress plugins OptinMonster, TrustPulse, and PushEngage distributed via Awesome Motive's CDN. All versions served through the compromised CDN infrastructure are potentially affected.
criticalbug_reportVulnerabilityEverest Forms Pro WordPress plugin under active exploit for site takeover
Everest Forms Pro plugin for WordPress. Specific affected versions not disclosed. All WordPress sites running this premium plugin are potentially at risk.
criticalbug_reportVulnerabilityActive exploitation of RCE flaw in Everest Forms Pro WordPress plugin
Everest Forms Pro WordPress plugin versions up to 1.9.12. Approximately 4,000 active installations at risk.