Threat Log

Nothing in the entire threat log matches that search. Try a shorter term, for example just the product name or the CVE number.

1. For the record Wordfence

   Meta for WooCommerce

   CVE-2026-66707

   Affects you if you run Meta for WooCommerce in a version up to and including 3.7.5.

   An attacker can exploit a stored cross-site scripting vulnerability without logging in. The malicious script stays on the server and runs in the browser of every visitor who loads the affected page. This allows session takeover, hijacking of administrator accounts, or using the site for phishing.

   Update to version 3.7.6.

   Affected

   Meta for WooCommerce

   Fixed in

   3.7.6

   CVSS

   7.1
   source audit@patchstack.com

   Login required

   no

   Likely to be exploited

   0.15 %
   percentile 5.2

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-31

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

2. For the record Wordfence

   Meta pixel for WordPress

   CVE-2026-66705

   Affects you if you run Meta pixel for WordPress in a version up to and including 5.2.1.

   A stranger can trigger a stored cross-site scripting vulnerability without logging in. The plugin is widely installed, so the likelihood of someone trying is high.

   Update to version 5.2.2.

   Affected

   Meta pixel for WordPress

   Fixed in

   5.2.2

   CVSS

   7.1
   source audit@patchstack.com

   Login required

   no

   Likely to be exploited

   0.15 %
   percentile 4.4

   Type

   CWE-79

   Actively exploited

   not on the KEV list

   Published

   2026-07-31

   Sources: NVD · EPSS · Wordfence
   Includes data from the CVE Program, © MITRE Corporation.

3. Act now Added manually Exploited in the wild

   WordPress Core (wp2shell)

   CVE-2026-63030 and 1 more

   Affects you if you run WordPress 6.9 or 7.0 and the REST API is reachable from outside. Out of the box, it is.

   A route confusion in the REST API batch endpoint. On its own it would be a blemish. Combined with the SQL injection in CVE-2026-60137 it turns into access to your database, with no account, no password, from the outside, and subsequently code execution on the server.

   Both flaws sit in the core, not in a plugin. That means every installation that has not been updated is affected, regardless of which extensions you use.

   Update to 6.9.5 or 7.0.2. The same update closes both holes. If your installation has not been updated since July 17, do not assume nothing happened. Go and look.

   Affected

   WordPress Core (wp2shell)

   CVSS

   9.8
   source contact@wpscan.com

   Login required

   no

   Likely to be exploited

   95.60 %
   percentile 99.9

   Type

   CWE-436

   Actively exploited

   KEV since 2026-07-21

   Published

   2026-07-17

   Sources: Sicherheitshinweis · Hersteller · NVD · EPSS · CISA KEV

4. For the record Debian Security

   libheif

   CVE-2025-68431 and 11 more

   Affects you if your servers process HEIF or AVIF images, for example through ImageMagick or WordPress uploads.

   A buffer over-read when decoding HEIF files with crafted overlay data. An attacker can prepare an image that makes the library read past the end of a memory region and crash. The classic path to code execution via an uploaded file is conceivable, even though the source only describes the crash here.

   Update libheif to version 1.21.0. If the update is not yet available for your system, avoid processing images with iovl overlay boxes until it is.

   Affected

   libheif

   CVSS

   6.5
   source security-advisories@github.com

   Login required

   no

   Likely to be exploited

   0.29 %
   percentile 21.3

   Type

   CWE-125, CWE-190

   Actively exploited

   not on the KEV list

   Published

   2025-12-29

   Sources: NVD · EPSS · Debian DSA