intelligent piXel

Threat Log

626advisories read
281affect you
345checked and dismissed
As of

Updated every 6 hours
Subscribe via RSS
10 of 281 entries
  1. For the record Wordfence

    Mapster WP Maps

    CVE-2026-14839

    Affects you if you run the Mapster WP Maps plugin in a version below 1.24.0 and the REST endpoint is reachable from the outside.

    The plugin exposes the title and full content of posts through a public REST endpoint without checking the post status. An unauthenticated attacker can read unpublished posts, including drafts, pending, private, and trashed posts.

    The vulnerability is not listed in the KEV catalog of actively exploited vulnerabilities.

    Update to version 1.24.0.

    Affected
    Mapster WP Maps
    Fixed in
    1.24.0
    CVSS
    7.5
    source 134c704f-9b21-4f2e-91b3-4a467353bcc0
    Login required
    no
    Likely to be exploited
    0.26 %
    percentile 17.2
    Type
    CWE-200
    Actively exploited
    not on the KEV list
    Published
    2026-08-01

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  2. For the record Wordfence

    Event Tickets and Registration

    CVE-2026-14822

    Affects you if you run the Event Tickets and Registration plugin in a version below 5.29.0.1 and manage orders through the REST API.

    A REST endpoint is missing an authorization check. An unauthenticated attacker can change the status of existing orders through it. The source does not name any further impact.

    Update to version 5.29.0.1.

    Affected
    Event Tickets and Registration
    Fixed in
    5.29.0.1
    CVSS
    5.3
    source 134c704f-9b21-4f2e-91b3-4a467353bcc0
    Login required
    no
    Likely to be exploited
    0.18 %
    percentile 7.9
    Type
    CWE-284
    Actively exploited
    not on the KEV list
    Published
    2026-08-01

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  3. For the record Wordfence

    Admin Columns for ACF Fields

    CVE-2026-15262

    Affects you if you run the Admin Columns for ACF Fields plugin up to and including version 0.3.2 and have authenticated users with at least contributor-level access.

    The plugin does not sanitize Advanced Custom Fields values before outputting them in the admin list-table columns. An authenticated user with contributor access or above can store a script that executes when a higher-privileged user views the affected list screen.

    No fixed version is known for this vulnerability. Deactivate the plugin until an update is released.

    Affected
    Admin Columns for ACF Fields
    CVSS
    5.4
    source 134c704f-9b21-4f2e-91b3-4a467353bcc0
    Login required
    yes, user account
    Likely to be exploited
    0.13 %
    percentile 3.2
    Type
    CWE-79
    Actively exploited
    not on the KEV list
    Published
    2026-08-01

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  4. For the record Wordfence

    Codeless Page Builder

    CVE-2026-15234

    Affects you if you use the Codeless Page Builder plugin through version 1.1.4 and have authenticated users with the Contributor role or above.

    An authenticated user with the Contributor role or above can inject scripts into pages that execute in the session of a higher-privileged user, such as an administrator, when that user views the page. The source does not name a fixed version or a workaround.

    The source does not name a fixed version or a workaround. Deactivate the plugin until a fixed version is released.

    Affected
    Codeless Page Builder
    CVSS
    5.4
    source 134c704f-9b21-4f2e-91b3-4a467353bcc0
    Login required
    yes, user account
    Likely to be exploited
    0.13 %
    percentile 3.2
    Type
    CWE-79
    Actively exploited
    not on the KEV list
    Published
    2026-08-01

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  5. Act now Wordfence

    Bit integrations

    CVE-2026-15006

    Affects you if you use the WordPress plugin Bit integrations in a version up to and including 2.9.0 and have the Contact Form 7 File Upload field enabled.

    An attacker can read arbitrary files on the server without logging in. The flaw is in how file attachments uploaded through an optional Contact Form 7 field are processed. What passes as a harmless file can be a path that reads out the system. Configuration files, credentials, anything the web server can read is reachable.

    Update to version 2.9.1. The source provides no workaround that closes the hole without the update.

    Affected
    Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
    Fixed in
    2.9.1
    CVSS
    7.5
    source security@wordfence.com
    Login required
    no
    Likely to be exploited
    0.83 %
    percentile 54.5
    Type
    CWE-22
    Actively exploited
    not on the KEV list
    Published
    2026-07-31

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  6. Act now Wordfence

    FormGent

    CVE-2026-3141

    Affects you if you use the FormGent WordPress plugin in versions up to and including 1.9.2.

    A REST endpoint in the plugin is missing a capability check. An attacker with no account can delete files in the plugin's upload directory. On Linux servers where the wp-content/uploads/formgent directory does not yet exist – which is the default state right after installation – the path traversal protection can be bypassed. That makes files outside that directory reachable.

    Update to version 1.10.0.

    Affected
    FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
    Fixed in
    1.10.0
    CVSS
    9.1
    source security@wordfence.com
    Login required
    no
    Likely to be exploited
    0.47 %
    percentile 38.3
    Type
    CWE-862
    Actively exploited
    not on the KEV list
    Published
    2026-07-31

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  7. Act now Wordfence

    Database Collation Fix

    CVE-2026-15018

    Affects you if you run the Database Collation Fix plugin in a version up to and including 1.2.10 and the file trigger.txt exists in the plugin directory. The file is created by certain DesktopServer integration events.

    An SQL injection that requires no login. An attacker can append their own database queries to existing queries via the force-collation-algorithm parameter and extract contents from the database. The prerequisite is that the file trigger.txt sits in the plugin folder. That happens during DesktopServer integration events, such as site creation. If the file is not there, the vulnerability goes nowhere.

    The CVSS of 5.3 is misleading. It reflects the trigger file condition, not what follows after the database is read. Whoever has access to the database has access to everything in it. That is why this entry is here and not in the filter.

    Remove the plugin or update to version 1.2.11. Then delete the trigger.txt file if it exists and check the database for unknown queries.

    Affected
    Database Collation Fix
    Fixed in
    1.2.11
    CVSS
    5.3
    source security@wordfence.com
    Login required
    yes, user account
    Likely to be exploited
    0.27 %
    percentile 18.4
    Type
    CWE-89
    Actively exploited
    not on the KEV list
    Published
    2026-07-31

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  8. Act now Wordfence

    MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder

    CVE-2026-15052

    Affects you if you run the plugin MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder in a version up to and including 4.3.3.

    An attacker can store scripts in form fields without logging in. The scripts execute in the browser of anyone visiting the affected page. This ranges from redirecting visitors to external sites to stealing an administrator's session data.

    Update to version 4.3.4.

    Affected
    MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder
    Fixed in
    4.3.4
    CVSS
    7.2
    source security@wordfence.com
    Login required
    no
    Likely to be exploited
    0.24 %
    percentile 15.4
    Type
    CWE-79
    Actively exploited
    not on the KEV list
    Published
    2026-07-31

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  9. Act now Wordfence

    Jeg Kit for Elementor

    CVE-2026-2916

    Affects you if you run Jeg Kit for Elementor up to and including version 3.1.1 and users with at least Contributor access can edit posts.

    The plugin writes a full inventory of all installed plugins, system information, and in some cases API keys into a JavaScript variable on the post edit page. Anyone who can edit a post can read this data in plain text. An attacker with a Contributor account can see which other plugins are running in which version and whether usable keys like the Mailchimp API key are exposed.

    Update to version 3.1.2.

    Affected
    Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
    Fixed in
    3.1.2
    CVSS
    4.3
    source security@wordfence.com
    Login required
    yes, user account
    Likely to be exploited
    0.22 %
    percentile 12.3
    Type
    CWE-200
    Actively exploited
    not on the KEV list
    Published
    2026-07-31

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  10. This week Wordfence

    WooCommerce PayPal Payments

    CVE-2025-14073

    Affects you if you run WooCommerce PayPal Payments in version 3.3.2 or older and process orders through your shop.

    A missing check at a point that displays order data. Without login, someone can reach order information via a sequential number, including the order key. With that key, full customer details can be retrieved within 10 minutes of order placement: name, email, phone, address.

    This is not a hole that wrings the password from your server. But it exposes every purchase, and whoever collects customer data does not need long to turn it into profit.

    Update the plugin to the latest version and check whether there have been unusual accesses to order data in the last few days.

    Affected
    WooCommerce PayPal Payments
    Fixed in
    3.4.0
    CVSS
    5.3
    source security@wordfence.com
    Login required
    no
    Likely to be exploited
    0.23 %
    percentile 14.2
    Type
    CWE-639
    Actively exploited
    not on the KEV list
    Published
    2026-07-31

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

345 checked and dismissed, with reasons
  • 157 advisoriesProdukt kommt in keinem der von mir betreuten Systeme vor.
  • 16 advisoriesKernel-Abwandlung fuer Hardware oder Cloud-Plattformen, die hier nicht vorkommt.
  • 10 advisoriesArbeitsplatzsoftware, nicht Serverbetrieb. Gehoert nicht in dieses Lagebild.
  • 7 advisoriesKeine Virtualisierungs- oder Orchestrierungsschicht in den betreuten Systemen.
  • 7 advisoriesKeine Netzwerkgeraete dieser Hersteller im Bestand.
  • 4 advisoriesIch betreibe keine Windows-Server. Warum, steht auf der Startseite.
  • 2 advisoriesKein Java-Anwendungsserver im Bestand.
  • 2 advisoriesBetreibt unter meinen Kunden niemand.
  • CVE-2026-64561Lokale Rechteausweitung im KVM-Subsystem, setzt ein Konto auf der Maschine voraus und betrifft nur Virtualisierungsumgebungen, die George nicht betreibt.
  • CVE-2024-39929Exim wird auf Georges Servern nicht betrieben, und die Schwachstelle betrifft nur Mailserver, die Exim einsetzen.
  • CVE-2022-49732Lokale Kernel-Schwachstelle ohne KEV-Eintrag und mit minimalem EPSS-Wert; auf gehärteten Servern ohne unberechtigte Konten kein Handlungsbedarf.
  • CVE-2025-21894Lokale Kernel-Schwachstelle in einem Netzwerktreiber, die ein lokales Konto voraussetzt und nicht aktiv ausgenutzt wird; kein Handlungsbedarf für die betreuten Systeme.
  • CVE-2025-38238Lokale Kernel-Schwachstelle in einem Fibre-Channel-Treiber, der auf den Servern nicht vorkommt; kein Handlungsbedarf.
  • CVE-2023-38709Betrifft Apache HTTP Server, den George nicht betreibt; für Kunden mit Apache-Hostern nur ein Hinweis, kein Handlungsbedarf für Georges Systeme.
  • CVE-2020-24588Wi-Fi-Schwachstelle betrifft Arbeitsplatzgeräte, nicht die gehärteten Server; kein Handlungsbedarf.
  • CVE-2025-38554Lokale UAF im VMA-Management, erfordert lokales Konto und ist eine Race-Condition ohne praktische Fernausnutzung.
  • CVE-2022-50697Lokale Kernel-Schwachstelle im MRP-Protokoll, nicht ohne Konto ausnutzbar.
  • CVE-2025-68767Lokaler Bug im hfsplus-Dateisystem, setzt ein Konto voraus und betrifft ein Dateisystem, das auf Georges Servern nicht vorkommt.
  • CVE-2026-45185Exim wird nicht betrieben, daher keine Betroffenheit für die betreuten Systeme.
  • CVE-2026-43495Lokaler Bug im WWAN-Treiber, hardware-spezifisch und erfordert ein Konto oder manipuliertes Modem.
  • CVE-2025-37780Lokaler Bug im isofs-Dateisystem, setzt ein Konto voraus und betrifft ein Dateisystem, das auf Georges Servern nicht vorkommt.
  • CVE-2025-71313Lokaler NULL-Pointer-Bug im PCI-Endpoint-Treiber, hardware-spezifisch und ohne Fernausnutzung.
  • CVE-2026-29167Apache HTTP Server ist nicht Teil des betriebenen Stacks; für Kunden mit Apache-Hostern relevant, aber nicht für Georges betreute Systeme.
  • CVE-2025-71315Lokale Kernel-Schwachstelle in einem DRM-Treiber, der auf den Servern nicht vorkommt; kein Handlungsbedarf.
  • CVE-2026-46316Diese Kernel-Lücke betrifft KVM auf ARM64, was auf Georges Debian/Ubuntu-Servern nicht vorkommt.
  • CVE-2026-46331Lokale Rechteausweitung im Netzwerk-Subsystem des Kernels, die ein Konto auf der Maschine voraussetzt und daher für Georges gehärtete Server nicht relevant ist.
  • CVE-2026-0864Die Lücke im configparser-Modul von CPython erfordert Kontrolle über geschriebene Werte und ist für die Serverumgebung nicht praktisch ausnutzbar.
  • CVE-2026-52912Lokale Kernel-Lücke im netfilter-Subsystem, die ein Konto auf der Maschine voraussetzt und daher für Georges Systeme nicht relevant ist.
  • CVE-2026-52944Diese Kernel-Lücke betrifft ksmbd, den in-kernel SMB-Server, der auf Georges Webservern nicht betrieben wird.
  • CVE-2026-43503Lokale Rechteausweitung im Netzwerk-Subsystem des Kernels, die ein Konto auf der Maschine voraussetzt und daher für Georges gehärtete Server nicht relevant ist.
  • CVE-2026-32282Red Hat Satellite ist nicht Teil des betriebenen Stacks und wird von den Kunden nicht eingesetzt.
  • CVE-2026-15308Die Lücke im HTML-Parser von CPython ermöglicht nur Denial of Service und erfordert, dass der Parser mit unkontrollierten Daten gefüttert wird, was auf Georges Servern nicht der Fall ist.
  • CVE-2026-13149Die Lücke betrifft Red Hat Ansible Automation Platform, die auf Georges Servern nicht betrieben wird.