CVE-2026-3585: Path Traversal in The Events Calendar Exposes Site Credentials
A path traversal vulnerability in The Events Calendar (CVE-2026-3585) shows how a skipped update and a lingering author…
Category
Security
CVE-2025-13486: The Unauthenticated RCE That Slipped Into 100,000 WordPress Sites
A CVSS 9.8 Remote Code Execution flaw in Advanced Custom Fields: Extended left 100,000 WordPress sites open to…
The Admin Account Nobody Created
A routine WordPress maintenance check turns up two unfamiliar admin accounts - and a 9.8 CVSS vulnerability hiding…
CVE-2024-30502: Unauthenticated SQL Injection in WP Travel Engine
CVE-2024-30502 is a CVSS 9.3 unauthenticated SQL injection in WP Travel Engine affecting versions up to 5.7.9. No…
How to Get Instant WordPress Security Alerts (Before the Damage Is Done)
Most WordPress breaches go undetected for days. Here's how to set up security alerts in Trusti Security so…
CVE-2025-69045: SQL Injection in FooEvents Requires Only a Subscriber Account
CVE-2025-69045 lets any subscriber-level user - anyone who registers a free account - run SQL commands against a…
7 WordPress Security Mistakes That Leave Your Site Wide Open
Most WordPress sites get hacked not because of sophisticated attacks, but because of simple mistakes that are easy…
WordPress Vulnerability Scanning: Find Security Holes Before Hackers Do
Vulnerabilities in plugins and themes are weaponized within hours of disclosure. Real-time scanning with Trusti Security ensures you…
What Are Security Headers and Why Your WordPress Site Needs Them
Security headers are your first line of browser-level defense. Learn what each header does and how to enable…
Two-Factor Authentication for WordPress: A Complete Setup Guide
2FA blocks the overwhelming majority of automated account takeovers. Here's how to set it up properly on your…