PHP Supply Chain Attack: Backdoor Discovered in Popular Composer Package
A supply chain attack targeting the PHP ecosystem has been discovered this week. Security researchers found a backdoor…
Blog
CrawlerX Botnet Evolves: New Variant Targets WooCommerce Sites
Security researchers have identified a new variant of the CrawlerX botnet that specifically targets WooCommerce sites. The latest…
WordPress Security Hardening Checklist: 15 Steps to Secure Your Site
A hardened WordPress site is one where every attack surface is minimized, every configuration is intentional, and no…
WordPress Database Security: Best Practices for Securing MySQL
Your WordPress database contains everything that makes your site your site: posts, user accounts, plugin settings, WooCommerce orders,…
WordPress Cron Security: How to Protect wp-cron.php and Scheduled Tasks
WordPress uses a built-in cron system (wp-cron.php) to schedule tasks like checking for updates, publishing scheduled posts, running…
CVE-2025-13456: Reflected XSS in ShopBuilder WooCommerce Plugin (CVSS 6.1)
A Reflected Cross-Site Scripting vulnerability has been discovered in the ShopBuilder WordPress plugin for WooCommerce. Tracked as CVE-2025-13456…
CVE-2025-13153: Stored XSS in Logo Slider WordPress Plugin (CVSS 6.1)
A Cross-Site Scripting (XSS) vulnerability has been discovered in the Logo Slider WordPress plugin. Tracked as CVE-2025-13153 with…
CVE-2025-12685: CSRF Vulnerability in WPBookit Plugin Allows Customer Deletion
CVE-2025-12685 WPBookit CSRF Privilege Escalation. A Cross-Site Request Forgery (CSRF) vulnerability affects the WPBookit WordPress plugin. Tracked as…
CVE-2025-14047: Unauthorized Data Loss in WP User Frontend Plugin
CVE-2025-14047 WP User Frontend SQL Injection. An unauthorized data loss vulnerability affects the WP User Frontend plugin for…
CVE-2025-14428: Missing Capability Check in My Sticky Elements Plugin
A missing capability check vulnerability affects the My Sticky Elements plugin for WordPress. Tracked as CVE-2025-14428 with a…