Security and Security Updates

The Events Calendar CVE-2026-95606 is a critical security vulnerability affecting the popular The Events Calendar WordPress plugin. The vulnerability allows unauthenticated attackers to inject malicious PHP objects through the unsafe deserialization of untrusted data. With a CVSS score of 9.8 and more than 600,000 active plugin installations, this security issue deserves immediate attention from WordPress […]

Click to Chat CVE-2026-92097 is a security vulnerability affecting the popular Click to Chat – HoliThemes WordPress plugin, which has more than 600,000 active installations. The vulnerability allows unauthenticated attackers to execute registered WordPress shortcodes under specific conditions. Plugin versions up to and including 4.44 are affected. The developer has addressed the issue in version […]

Magento vulnerability CVE-2026-103849 is a critical security flaw affecting Adobe Commerce and Magento Open Source, with a maximum CVSS score of 10.0. On October 13, 2026, Adobe released security bulletin APSB26-153, addressing eleven vulnerabilities across its e-commerce platforms. The most severe vulnerability could allow unauthenticated attackers to execute arbitrary code. Organizations operating Magento or Adobe […]

Ghostscript CVE-2026-39919 is a critical security vulnerability that can allow remote code execution when a Linux server processes a specially crafted PDF document. Security researchers at Wordfence have demonstrated successful exploitation in a controlled WordPress environment. The vulnerability affects Ghostscript, a widely used PDF and PostScript processing application. Ghostscript is commonly used by other software, […]

Bricksforge CVE-2026-85097 is a critical WordPress security vulnerability that is actively being exploited by attackers. The flaw allows unauthenticated attackers to upload malicious PHP files to vulnerable WordPress websites and execute arbitrary code on the server. Security researchers at Patchstack have confirmed exploitation attempts targeting affected Bricksforge installations. The first attacks were observed on October […]

A critical Traveler vulnerability tracked as CVE-2026-93947 allows unauthenticated attackers to perform Blind SQL Injection against affected WordPress websites. The vulnerability affects Traveler theme versions up to and including 3.2.9 and has a CVSS 3.1 score of 9.3 Critical. Traveler is a commercial WordPress theme widely used for travel websites, hotel reservations, holiday rentals, tours […]

A critical Avada vulnerability tracked as CVE-2026-97670 allows unauthenticated attackers to trigger unauthorized WordPress actions under specific conditions. The security flaw affects Avada Builder, a core component of the popular Avada WordPress website builder. The vulnerability has a CVSS 3.1 score of 9.1 Critical. Successful exploitation can cause unauthorized changes to website content, permanent deletion […]

A serious LatePoint vulnerability can expose WordPress websites to SQL injection and privilege escalation. Security researchers have identified two separate security issues in the popular appointment booking plugin, tracked as CVE-2026-96662 and CVE-2026-104766. LatePoint is used by more than 100,000 WordPress websites to manage appointments, reservations, customers and online payments. Both vulnerabilities have been addressed […]

A Microsoft Exchange vulnerability tracked as CVE-2026-96940 can allow an authenticated attacker to remotely escalate privileges within an affected Exchange Server environment. The Dutch National Cyber Security Centre (NCSC) has published an alert about the vulnerability and advises organisations running Microsoft Exchange Server on-premises to install the available security update as soon as possible. CVE-2026-96940 […]