CVE-2024-28890 is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in the Forminator form builder plugin, installed on 500,000+ WordPress sites. Attackers could upload PHP web shells and fully take over vulnerable sites. Here…
Read ArticleA critical flaw in the Everest Forms WordPress plugin (100,000+ installs) let unauthenticated attackers upload, read, and delete…
CVE-2024-11205 is a missing authorization flaw in WPForms, the form builder active on over 6 million WordPress sites.…
A critical missing-authorization flaw (CVE-2025-11833, CVSS 9.8) in the Post SMTP plugin lets unauthenticated attackers read logged emails…
A critical flaw (CVSS 9.9) in the WPML multilingual plugin let authenticated Contributor-level users run arbitrary code through…
A critical SQL injection flaw in the popular WP-Automatic plugin let unauthenticated attackers run arbitrary database queries, forge…
CVE-2025-3102 is a high-severity authentication bypass in the OttoKit (formerly SureTriggers) automation plugin, installed on 100,000+ WordPress sites.…
CVE-2024-1071 is a critical (CVSS 9.8) unauthenticated SQL injection in the Ultimate Member plugin affecting versions 2.1.3 through…
A critical flaw (CVSS 9.8) in the CleanTalk Anti-Spam plugin let unauthenticated attackers bypass authorization through DNS spoofing…
A critical SQL injection flaw (CVSS 9.8) in the LayerSlider plugin let unauthenticated attackers extract data straight from…
