intelligent piXel

Threat Log

626advisories read
281affect you
345checked and dismissed
As of

Updated every 6 hours
Subscribe via RSS
10 of 281 entries
  1. For the record Wordfence

    Five Star Restaurant Reservations – WordPress Booking Plugin

    CVE-2026-15151

    Affects you if you run the Five Star Restaurant Reservations plugin below version 2.7.23 and users with low-level roles have access to the booking management.

    The plugin lacks a capability check on one of its AJAX actions. An authenticated attacker with a low booking-management role, which by default cannot access the plugin's settings, can reset the configured booking notification rules. This is not full access, but a targeted disruption of operations.

    The vulnerability is not on the KEV catalog of actively exploited flaws, and the likelihood of widespread exploitation is low with an EPSS of 0.2%. I classify it as informational because an attack requires an account and the damage is limited to resetting rules.

    Update to version 2.7.23.

    Affected
    Five Star Restaurant Reservations – WordPress Booking Plugin
    Fixed in
    2.7.23
    CVSS
    7.5
    source 134c704f-9b21-4f2e-91b3-4a467353bcc0
    Login required
    no
    Likely to be exploited
    0.23 %
    percentile 14.2
    Type
    CWE-284
    Actively exploited
    not on the KEV list
    Published
    2026-08-02

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  2. For the record Wordfence

    LWS Optimize – All-in-One Speed Booster & Cache Tools

    CVE-2026-16042

    Affects you if you run the LWS Optimize plugin in a version below 3.4 and have authenticated users with the subscriber role or higher.

    The plugin is missing a capability check on a function that flushes the cache. An authenticated user with the subscriber role or higher can trigger this action. The source describes the result as repeated cache rebuilds.

    Update to version 3.4.

    Affected
    LWS Optimize – All-in-One Speed Booster & Cache Tools
    Fixed in
    3.4
    CVSS
    4.3
    source 134c704f-9b21-4f2e-91b3-4a467353bcc0
    Login required
    yes, user account
    Likely to be exploited
    0.19 %
    percentile 9.4
    Type
    CWE-862
    Actively exploited
    not on the KEV list
    Published
    2026-08-02

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  3. For the record Wordfence

    FluentBoards

    CVE-2026-14938

    Affects you if you run FluentBoards in a version before 1.95.3 and authenticated users have member access to at least one board.

    An authenticated user with access to one board can read the data of another board through the import function. The check whether the selected board belongs to the user is missing. Titles, descriptions, and file attachments of tasks can be read.

    Update to version 1.95.3.

    Affected
    FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration
    Fixed in
    1.95.3
    CVSS
    4.3
    source 134c704f-9b21-4f2e-91b3-4a467353bcc0
    Login required
    yes, user account
    Likely to be exploited
    0.16 %
    percentile 5.8
    Type
    CWE-639
    Actively exploited
    not on the KEV list
    Published
    2026-08-02

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  4. For the record Wordfence

    Event Booking Manager for WooCommerce

    CVE-2026-16064

    Affects you if you run the Event Booking Manager for WooCommerce plugin in a version below 5.3.7 and have logged-in users with the Contributor role or above.

    When quick-editing events, the plugin does not check whether the user owns the post being modified. It only checks a global capability. A logged-in user with the Contributor role can thus change the title and publication status of arbitrary posts and pages, including content they do not own.

    The vulnerability is not listed in the KEV catalog of actively exploited flaws. It requires an account, which raises the bar, but the impact is tampering with content the user did not author.

    Update to version 5.3.7.

    Affected
    Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
    Fixed in
    5.3.7
    CVSS
    5.4
    source 134c704f-9b21-4f2e-91b3-4a467353bcc0
    Login required
    yes, user account
    Likely to be exploited
    0.14 %
    percentile 3.6
    Type
    CWE-863
    Actively exploited
    not on the KEV list
    Published
    2026-08-02

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  5. For the record Wordfence

    JetEngine

    CVE-2026-14864

    Affects you if you run the JetEngine WordPress plugin in a version below 3.8.12 and have authenticated users with the Contributor role or higher.

    An authenticated user with the Contributor role can place scripts in a post that execute in the browser of a higher-privileged user, such as an administrator, when the page is accessed. The source does not name any specific consequences beyond this mechanism.

    Update JetEngine to version 3.8.12.

    Affected
    JetEngine
    Fixed in
    3.8.12
    CVSS
    5.4
    source 134c704f-9b21-4f2e-91b3-4a467353bcc0
    Login required
    yes, user account
    Likely to be exploited
    0.13 %
    percentile 3.2
    Type
    CWE-79
    Actively exploited
    not on the KEV list
    Published
    2026-08-02

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  6. For the record Wordfence

    Narrative Publisher

    CVE-2026-16273

    Affects you if you run the Narrative Publisher WordPress plugin up to and including version 1.0.7 and have authenticated users with contributor-level access or above.

    The plugin allows users from the contributor role upward to store JavaScript in post fields that executes when a higher-privileged user views the affected post. An attacker with a contributor account can inject scripts that run in an administrator's browser.

    The source does not name a fixed version or a workaround.

    Deactivate the plugin until an update appears.

    Affected
    Narrative Publisher
    CVSS
    4.6
    source 134c704f-9b21-4f2e-91b3-4a467353bcc0
    Login required
    yes, user account
    Likely to be exploited
    0.13 %
    percentile 3.2
    Type
    CWE-79
    Actively exploited
    not on the KEV list
    Published
    2026-08-02

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  7. For the record Wordfence

    Frontend File Manager Plugin

    CVE-2026-16292

    Affects you if you run the Frontend File Manager Plugin up to and including version 23.6 in WordPress and an administrator clicks a crafted link while logged in. If guest uploads are enabled, the attack works without authentication.

    Missing nonce validation on a file metadata update action. An attacker can modify the metadata of an uploaded file and then download that file. They need to trick an administrator into clicking a forged link. With guest uploads enabled, that hurdle disappears and the attack works unauthenticated against any user's file.

    The source does not name a fixed version or a workaround. Disable the plugin until an update appears.

    Affected
    Frontend File Manager Plugin
    CVSS
    5.4
    source 134c704f-9b21-4f2e-91b3-4a467353bcc0
    Login required
    no
    Likely to be exploited
    0.09 %
    percentile 0.7
    Type
    CWE-352
    Actively exploited
    not on the KEV list
    Published
    2026-08-02

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  8. Act now Wordfence

    ShopLentor Pro

    CVE-2026-61972

    Affects you if you run ShopLentor Pro up to and including version 2.8.5.

    A broken access control that can be exploited without logging in. An attacker can reach functions that should require an account. What exactly they do with that depends on which functions the plugin exposes in the vulnerable area. The source does not give a definitive list, but the hole opens the door to settings and data not meant for strangers.

    Update to version 2.8.6.

    Affected
    ShopLentor Pro
    Fixed in
    2.8.6
    CVSS
    5.3
    source audit@patchstack.com
    Login required
    no
    Likely to be exploited
    0.21 %
    percentile 11.9
    Type
    CWE-862
    Actively exploited
    not on the KEV list
    Published
    2026-08-01

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  9. This week Wordfence

    CubeWP Framework

    CVE-2026-13339

    Affects you if you use the CubeWP Framework plugin and its posts shortcode or widget is rendered on a page with AJAX loading enabled.

    A directory traversal flaw that lets anyone read arbitrary files without logging in. The plugin emits a security token into the page markup, so any visitor can read it. That defeats the protection meant to keep people from opening files outside the intended directory. The result is read access to configuration files and other sensitive data on the server.

    Update the plugin to the latest version and check whether AJAX loading for the widget or shortcode is still necessary.

    Affected
    CubeWP Framework
    Fixed in
    1.1.31
    CVSS
    7.5
    source security@wordfence.com
    Login required
    no
    Likely to be exploited
    0.64 %
    percentile 47.5
    Type
    CWE-22
    Actively exploited
    not on the KEV list
    Published
    2026-08-01

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  10. For the record Wordfence

    User Access Manager

    CVE-2026-18352

    Affects you if you run the User Access Manager plugin in any version up to and including 2.3.15.

    The plugin is meant to control access to files. A flaw in how it handles the 'uamgetfile' parameter allows an attacker to bypass this control with a trick. By combining a valid attachment ID with a manipulated file path, an unauthenticated attacker can read arbitrary files on the server. The permission check passes against the legitimate public attachment, but the file streamed is the one the attacker specified in the path.

    Configuration files containing credentials or other sensitive information can be read. Read access to the filesystem is often the first step toward a full takeover.

    Update to the next available version after 2.3.15 or deactivate the plugin until the update is applied.

    Affected
    User Access Manager
    Fixed in
    2.3.16
    CVSS
    7.5
    source security@wordfence.com
    Login required
    no
    Likely to be exploited
    0.68 %
    percentile 49.0
    Type
    CWE-22
    Actively exploited
    not on the KEV list
    Published
    2026-08-01

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

345 checked and dismissed, with reasons
  • 157 advisoriesProdukt kommt in keinem der von mir betreuten Systeme vor.
  • 16 advisoriesKernel-Abwandlung fuer Hardware oder Cloud-Plattformen, die hier nicht vorkommt.
  • 10 advisoriesArbeitsplatzsoftware, nicht Serverbetrieb. Gehoert nicht in dieses Lagebild.
  • 7 advisoriesKeine Virtualisierungs- oder Orchestrierungsschicht in den betreuten Systemen.
  • 7 advisoriesKeine Netzwerkgeraete dieser Hersteller im Bestand.
  • 4 advisoriesIch betreibe keine Windows-Server. Warum, steht auf der Startseite.
  • 2 advisoriesKein Java-Anwendungsserver im Bestand.
  • 2 advisoriesBetreibt unter meinen Kunden niemand.
  • CVE-2026-64561Lokale Rechteausweitung im KVM-Subsystem, setzt ein Konto auf der Maschine voraus und betrifft nur Virtualisierungsumgebungen, die George nicht betreibt.
  • CVE-2024-39929Exim wird auf Georges Servern nicht betrieben, und die Schwachstelle betrifft nur Mailserver, die Exim einsetzen.
  • CVE-2022-49732Lokale Kernel-Schwachstelle ohne KEV-Eintrag und mit minimalem EPSS-Wert; auf gehärteten Servern ohne unberechtigte Konten kein Handlungsbedarf.
  • CVE-2025-21894Lokale Kernel-Schwachstelle in einem Netzwerktreiber, die ein lokales Konto voraussetzt und nicht aktiv ausgenutzt wird; kein Handlungsbedarf für die betreuten Systeme.
  • CVE-2025-38238Lokale Kernel-Schwachstelle in einem Fibre-Channel-Treiber, der auf den Servern nicht vorkommt; kein Handlungsbedarf.
  • CVE-2023-38709Betrifft Apache HTTP Server, den George nicht betreibt; für Kunden mit Apache-Hostern nur ein Hinweis, kein Handlungsbedarf für Georges Systeme.
  • CVE-2020-24588Wi-Fi-Schwachstelle betrifft Arbeitsplatzgeräte, nicht die gehärteten Server; kein Handlungsbedarf.
  • CVE-2025-38554Lokale UAF im VMA-Management, erfordert lokales Konto und ist eine Race-Condition ohne praktische Fernausnutzung.
  • CVE-2022-50697Lokale Kernel-Schwachstelle im MRP-Protokoll, nicht ohne Konto ausnutzbar.
  • CVE-2025-68767Lokaler Bug im hfsplus-Dateisystem, setzt ein Konto voraus und betrifft ein Dateisystem, das auf Georges Servern nicht vorkommt.
  • CVE-2026-45185Exim wird nicht betrieben, daher keine Betroffenheit für die betreuten Systeme.
  • CVE-2026-43495Lokaler Bug im WWAN-Treiber, hardware-spezifisch und erfordert ein Konto oder manipuliertes Modem.
  • CVE-2025-37780Lokaler Bug im isofs-Dateisystem, setzt ein Konto voraus und betrifft ein Dateisystem, das auf Georges Servern nicht vorkommt.
  • CVE-2025-71313Lokaler NULL-Pointer-Bug im PCI-Endpoint-Treiber, hardware-spezifisch und ohne Fernausnutzung.
  • CVE-2026-29167Apache HTTP Server ist nicht Teil des betriebenen Stacks; für Kunden mit Apache-Hostern relevant, aber nicht für Georges betreute Systeme.
  • CVE-2025-71315Lokale Kernel-Schwachstelle in einem DRM-Treiber, der auf den Servern nicht vorkommt; kein Handlungsbedarf.
  • CVE-2026-46316Diese Kernel-Lücke betrifft KVM auf ARM64, was auf Georges Debian/Ubuntu-Servern nicht vorkommt.
  • CVE-2026-46331Lokale Rechteausweitung im Netzwerk-Subsystem des Kernels, die ein Konto auf der Maschine voraussetzt und daher für Georges gehärtete Server nicht relevant ist.
  • CVE-2026-0864Die Lücke im configparser-Modul von CPython erfordert Kontrolle über geschriebene Werte und ist für die Serverumgebung nicht praktisch ausnutzbar.
  • CVE-2026-52912Lokale Kernel-Lücke im netfilter-Subsystem, die ein Konto auf der Maschine voraussetzt und daher für Georges Systeme nicht relevant ist.
  • CVE-2026-52944Diese Kernel-Lücke betrifft ksmbd, den in-kernel SMB-Server, der auf Georges Webservern nicht betrieben wird.
  • CVE-2026-43503Lokale Rechteausweitung im Netzwerk-Subsystem des Kernels, die ein Konto auf der Maschine voraussetzt und daher für Georges gehärtete Server nicht relevant ist.
  • CVE-2026-32282Red Hat Satellite ist nicht Teil des betriebenen Stacks und wird von den Kunden nicht eingesetzt.
  • CVE-2026-15308Die Lücke im HTML-Parser von CPython ermöglicht nur Denial of Service und erfordert, dass der Parser mit unkontrollierten Daten gefüttert wird, was auf Georges Servern nicht der Fall ist.
  • CVE-2026-13149Die Lücke betrifft Red Hat Ansible Automation Platform, die auf Georges Servern nicht betrieben wird.