intelligent piXel

Threat Log

626advisories read
281affect you
345checked and dismissed
As of

Updated every 6 hours
Subscribe via RSS
10 of 281 entries
  1. For the record Wordfence

    wiseCampaign

    CVE-2026-7529

    Affects you if you have the wiseCampaign plugin installed on your WordPress site in a version up to and including 1.1.16.

    Every REST endpoint of the plugin is reachable without authentication or capability check. An attacker can read and modify the entire plugin configuration, swap banners and background images, and toggle features on and off. This is not a subtle attack; it is a wide-open barn door.

    Update to version 1.1.17 and check the plugin settings and uploaded banner files for unwanted changes.

    Affected
    wiseCampaign – WooCommerce Conversions Made Easy
    Fixed in
    1.1.17
    CVSS
    7.5
    source security@wordfence.com
    Login required
    no
    Likely to be exploited
    0.35 %
    percentile 28.0
    Type
    CWE-862
    Actively exploited
    not on the KEV list
    Published
    2026-08-04

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  2. For the record Wordfence

    Seraphinite Accelerator

    CVE-2026-17532

    Affects you if you run Seraphinite Accelerator up to and including 2.29.18 and an attacker can lure one of your users to a crafted address.

    A reflected cross-site scripting vulnerability. An attacker can execute script code in the context of your site when a logged-in user follows a manipulated link. The flaw stems from a loose comparison during a signature check, combined with insufficient output escaping. This allows injecting malicious code directly into the page response.

    The vulnerability is not on the KEV catalog of actively exploited issues and has a low EPSS score. I am filing it for awareness because an attack requires user interaction and the damage is limited to that user's session.

    Update to version 2.29.19.

    Affected
    Seraphinite Accelerator
    Fixed in
    2.29.19
    CVSS
    6.1
    source security@wordfence.com
    Login required
    no
    Likely to be exploited
    0.35 %
    percentile 27.6
    Type
    CWE-79
    Actively exploited
    not on the KEV list
    Published
    2026-08-04

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  3. For the record Wordfence

    User Access Manager

    CVE-2026-15281

    Affects you if you run the WordPress plugin User Access Manager up to and including version 2.3.12 and your site allows user accounts with subscriber-level access or above.

    A SQL injection that an attacker can trigger with a simple subscriber account. The plugin code stores an insufficiently validated value in the database and later retrieves it to insert it unfiltered into a SQL query. A subscriber can thus manipulate database queries.

    This vulnerability is not listed in the KEV catalog of actively exploited flaws. That is a snapshot, not a guarantee that nobody is exploiting it. If you allow subscriber accounts, do not postpone the update.

    Update to version 2.3.13.

    Affected
    User Access Manager
    Fixed in
    2.3.13
    CVSS
    6.5
    source security@wordfence.com
    Login required
    yes, user account
    Likely to be exploited
    0.34 %
    percentile 26.4
    Type
    CWE-89
    Actively exploited
    not on the KEV list
    Published
    2026-08-04

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  4. For the record Wordfence

    Smart Popup by Supsystic

    CVE-2026-18322

    Affects you if you run the WordPress plugin Smart Popup by Supsystic in a version up to and including 1.12.0.

    An unauthenticated privilege escalation. A flaw in the plugin's permission check allows calling the protected user creation action. The required nonce is also leaked in the subscriber confirmation email. Combined with a missing role check, a stranger can register themselves as an administrator.

    Update to version 1.13.0. Then check your user list for unknown administrators.

    Affected
    Smart Popup by Supsystic
    Fixed in
    1.13.0
    CVSS
    8.8
    source security@wordfence.com
    Login required
    yes, user account
    Likely to be exploited
    0.31 %
    percentile 24.0
    Type
    CWE-269
    Actively exploited
    not on the KEV list
    Published
    2026-08-04

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  5. For the record Wordfence

    Kirki – Freeform Page Builder, Website Builder & Customizer

    CVE-2026-12720

    Affects you if you run the Kirki plugin in a version below 6.0.13.

    An unauthenticated attacker can store data that, when deserialized by an administrator, may lead to the instantiation of arbitrary classes. The plugin itself does not contain a known POP chain, according to the source. If such a chain is present through another plugin or theme on the system, the attacker could delete files, retrieve sensitive data, or execute code.

    This vulnerability is not listed in the KEV catalog of actively exploited vulnerabilities.

    Update to version 6.0.13.

    Affected
    Kirki – Freeform Page Builder, Website Builder & Customizer
    Fixed in
    6.0.13
    CVSS
    7.5
    source 134c704f-9b21-4f2e-91b3-4a467353bcc0
    Login required
    no
    Likely to be exploited
    0.30 %
    percentile 22.9
    Type
    CWE-502
    Actively exploited
    not on the KEV list
    Published
    2026-08-04

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  6. For the record Wordfence

    MailChimp Forms by MailMunch

    CVE-2026-7520

    Affects you if you use the MailChimp Forms by MailMunch plugin in a version up to and including 3.2.7 and users with the subscriber role or higher have access to your installation.

    The sign-in and sign-up AJAX actions do not check whether the user has the necessary capabilities. An attacker with a subscriber-level account can relink the plugin's integration to their own MailMunch credentials. From then on, all new sign-ups through your forms go to their account, and the forms and landing pages displayed on your site are pulled from their MailMunch account.

    Update to version 3.2.8.

    Affected
    Mailmunch Forms for Mailchimp
    Fixed in
    3.2.8
    CVSS
    8.1
    source security@wordfence.com
    Login required
    yes, user account
    Likely to be exploited
    0.27 %
    percentile 19.0
    Type
    CWE-862
    Actively exploited
    not on the KEV list
    Published
    2026-08-04

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  7. For the record Wordfence

    Relevanssi

    CVE-2026-15941

    Affects you if you run Relevanssi or Relevanssi Premium and users with the Contributor role or higher have access to the WordPress dashboard.

    A SQL injection through the plugin's admin search. An attacker with a Contributor account can use it to blindly read data from the database. The attack takes time because the database response is not directly visible but must be inferred through time delays.

    The vulnerability is not on the KEV catalog of actively exploited flaws. A Contributor account is the prerequisite. That makes a mass attack unlikely, but it is suitable for a targeted attack on an installation where an attacker already has such an account.

    Update Relevanssi to 4.27.2 or Relevanssi Premium to 2.30.3.

    Affected
    Relevanssi Premium – A Better Search, Relevanssi – A Better Search
    Fixed in
    2.30.3, 4.27.2
    CVSS
    6.5
    source security@wordfence.com
    Login required
    yes, user account
    Likely to be exploited
    0.25 %
    percentile 16.3
    Type
    CWE-89
    Actively exploited
    not on the KEV list
    Published
    2026-08-04

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  8. For the record Wordfence

    JetFormBuilder — Dynamic Blocks Form Builder

    CVE-2026-28140

    Affects you if you run the JetFormBuilder plugin in a version up to and including 3.6.4.1.

    An unauthenticated visitor is missing an authorization check. They can perform an action they are not entitled to. The source does not specify which action.

    Update to version 3.6.4.2.

    Affected
    JetFormBuilder — Dynamic Blocks Form Builder
    Fixed in
    3.6.4.2
    CVSS
    7.5
    source audit@patchstack.com
    Login required
    no
    Likely to be exploited
    0.25 %
    percentile 15.9
    Type
    CWE-862
    Actively exploited
    not on the KEV list
    Published
    2026-08-04

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  9. For the record Wordfence

    Smash Balloon Social Photo Feed

    CVE-2026-15452

    Affects you if you run the Smash Balloon Social Photo Feed plugin in a version up to and including 6.11.3.

    A reflected cross-site scripting vulnerability. An attacker can place malicious code in the address bar. To do so, they need to trick someone with access to the site into clicking a crafted link. If that succeeds, the victim's browser executes the script as if it came from your site.

    The vulnerability is not listed in the CISA KEV catalog of actively exploited flaws. No active attack is currently known. That justifies the informational rating.

    Update to version 6.11.4.

    Affected
    Smash Balloon Social Photo Feed – Easy Social Feeds Plugin
    Fixed in
    6.11.4
    CVSS
    4.7
    source security@wordfence.com
    Login required
    no
    Likely to be exploited
    0.24 %
    percentile 15.1
    Type
    CWE-79
    Actively exploited
    not on the KEV list
    Published
    2026-08-04

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  10. For the record Wordfence

    VikRentItems Flexible Rental Management System

    CVE-2026-16143

    Affects you if you run the VikRentItems Flexible Rental Management System plugin in a version up to and including 1.2.1 and the guest booking form is enabled.

    An attacker can place a booking without an account and inject malicious code into the email field. The code is stored and later executed in the admin area as soon as someone views the booking. This is a classic stored XSS that enters through an insufficiently sanitized form field.

    The vulnerability is not critical because it requires interaction in the backend and the likelihood of exploitation is low. It is still listed here because it works without authentication and may appear on the managed systems.

    Update to version 1.2.2.

    Affected
    VikRentItems Flexible Rental Management System
    Fixed in
    1.2.2
    CVSS
    7.2
    source security@wordfence.com
    Login required
    no
    Likely to be exploited
    0.24 %
    percentile 14.7
    Type
    CWE-79
    Actively exploited
    not on the KEV list
    Published
    2026-08-04

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

345 checked and dismissed, with reasons
  • 157 advisoriesProdukt kommt in keinem der von mir betreuten Systeme vor.
  • 16 advisoriesKernel-Abwandlung fuer Hardware oder Cloud-Plattformen, die hier nicht vorkommt.
  • 10 advisoriesArbeitsplatzsoftware, nicht Serverbetrieb. Gehoert nicht in dieses Lagebild.
  • 7 advisoriesKeine Virtualisierungs- oder Orchestrierungsschicht in den betreuten Systemen.
  • 7 advisoriesKeine Netzwerkgeraete dieser Hersteller im Bestand.
  • 4 advisoriesIch betreibe keine Windows-Server. Warum, steht auf der Startseite.
  • 2 advisoriesKein Java-Anwendungsserver im Bestand.
  • 2 advisoriesBetreibt unter meinen Kunden niemand.
  • CVE-2026-64561Lokale Rechteausweitung im KVM-Subsystem, setzt ein Konto auf der Maschine voraus und betrifft nur Virtualisierungsumgebungen, die George nicht betreibt.
  • CVE-2024-39929Exim wird auf Georges Servern nicht betrieben, und die Schwachstelle betrifft nur Mailserver, die Exim einsetzen.
  • CVE-2022-49732Lokale Kernel-Schwachstelle ohne KEV-Eintrag und mit minimalem EPSS-Wert; auf gehärteten Servern ohne unberechtigte Konten kein Handlungsbedarf.
  • CVE-2025-21894Lokale Kernel-Schwachstelle in einem Netzwerktreiber, die ein lokales Konto voraussetzt und nicht aktiv ausgenutzt wird; kein Handlungsbedarf für die betreuten Systeme.
  • CVE-2025-38238Lokale Kernel-Schwachstelle in einem Fibre-Channel-Treiber, der auf den Servern nicht vorkommt; kein Handlungsbedarf.
  • CVE-2023-38709Betrifft Apache HTTP Server, den George nicht betreibt; für Kunden mit Apache-Hostern nur ein Hinweis, kein Handlungsbedarf für Georges Systeme.
  • CVE-2020-24588Wi-Fi-Schwachstelle betrifft Arbeitsplatzgeräte, nicht die gehärteten Server; kein Handlungsbedarf.
  • CVE-2025-38554Lokale UAF im VMA-Management, erfordert lokales Konto und ist eine Race-Condition ohne praktische Fernausnutzung.
  • CVE-2022-50697Lokale Kernel-Schwachstelle im MRP-Protokoll, nicht ohne Konto ausnutzbar.
  • CVE-2025-68767Lokaler Bug im hfsplus-Dateisystem, setzt ein Konto voraus und betrifft ein Dateisystem, das auf Georges Servern nicht vorkommt.
  • CVE-2026-45185Exim wird nicht betrieben, daher keine Betroffenheit für die betreuten Systeme.
  • CVE-2026-43495Lokaler Bug im WWAN-Treiber, hardware-spezifisch und erfordert ein Konto oder manipuliertes Modem.
  • CVE-2025-37780Lokaler Bug im isofs-Dateisystem, setzt ein Konto voraus und betrifft ein Dateisystem, das auf Georges Servern nicht vorkommt.
  • CVE-2025-71313Lokaler NULL-Pointer-Bug im PCI-Endpoint-Treiber, hardware-spezifisch und ohne Fernausnutzung.
  • CVE-2026-29167Apache HTTP Server ist nicht Teil des betriebenen Stacks; für Kunden mit Apache-Hostern relevant, aber nicht für Georges betreute Systeme.
  • CVE-2025-71315Lokale Kernel-Schwachstelle in einem DRM-Treiber, der auf den Servern nicht vorkommt; kein Handlungsbedarf.
  • CVE-2026-46316Diese Kernel-Lücke betrifft KVM auf ARM64, was auf Georges Debian/Ubuntu-Servern nicht vorkommt.
  • CVE-2026-46331Lokale Rechteausweitung im Netzwerk-Subsystem des Kernels, die ein Konto auf der Maschine voraussetzt und daher für Georges gehärtete Server nicht relevant ist.
  • CVE-2026-0864Die Lücke im configparser-Modul von CPython erfordert Kontrolle über geschriebene Werte und ist für die Serverumgebung nicht praktisch ausnutzbar.
  • CVE-2026-52912Lokale Kernel-Lücke im netfilter-Subsystem, die ein Konto auf der Maschine voraussetzt und daher für Georges Systeme nicht relevant ist.
  • CVE-2026-52944Diese Kernel-Lücke betrifft ksmbd, den in-kernel SMB-Server, der auf Georges Webservern nicht betrieben wird.
  • CVE-2026-43503Lokale Rechteausweitung im Netzwerk-Subsystem des Kernels, die ein Konto auf der Maschine voraussetzt und daher für Georges gehärtete Server nicht relevant ist.
  • CVE-2026-32282Red Hat Satellite ist nicht Teil des betriebenen Stacks und wird von den Kunden nicht eingesetzt.
  • CVE-2026-15308Die Lücke im HTML-Parser von CPython ermöglicht nur Denial of Service und erfordert, dass der Parser mit unkontrollierten Daten gefüttert wird, was auf Georges Servern nicht der Fall ist.
  • CVE-2026-13149Die Lücke betrifft Red Hat Ansible Automation Platform, die auf Georges Servern nicht betrieben wird.