intelligent piXel

Threat Log

988advisories read
1000affect you
-12checked and dismissed
As of

Updated every 6 hours
Subscribe via RSS
10 of 1000 entries
  1. This week Wordfence

    Snazzy Social Media Feed

    CVE-2026-110002

    Affects you if you use Snazzy Social Media Feed through 2.5 and an attacker has an account with subscriber-level access or higher.

    The plugin allows arbitrary file uploads. According to the source, this can make code execution possible. The source attributes this to missing checks and insufficient sanitization of an input.

    I rate this as critical because the described impact does not require an administrator account. It is not listed in CISA's KEV catalog of actively exploited vulnerabilities.

    The source does not name a fixed version or a workaround.

    Affected
    Snazzy Social Media Feed
    CVSS
    9.8
    source Wordfence
    Login required
    no
    Likely to be exploited
    0.98 %
    percentile 61.8
    Type
    CWE-434
    Actively exploited
    not on the KEV list
    Published
    2026-10-13

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  2. This week Wordfence

    Printcart Store

    CVE-2026-93388

    Affects you if you use Printcart Store through 2.9.1. The plugin allows unauthenticated file uploads that can lead to remote code execution.

    The source describes an arbitrary file upload without authentication that can lead to remote code execution. I rate this as critical because of that impact and the 9.8 score.

    It is not listed in CISA's KEV catalog of actively exploited vulnerabilities. The source does not name any additional impact.

    Update Printcart Store to 2.9.2.

    Affected
    Printcart Store
    Fixed in
    2.9.2
    CVSS
    9.8
    source Wordfence
    Login required
    no
    Likely to be exploited
    0.85 %
    percentile 57.9
    Type
    CWE-434
    Actively exploited
    not on the KEV list
    Published
    2026-10-13

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  3. This week Wordfence

    BP Profile Search

    CVE-2026-104995

    Affects you if you use BP Profile Search through version 5.9. The source describes exploitation without authentication.

    I rate this vulnerability as serious. The source describes local file inclusion of arbitrary PHP files and names remote code execution as a possible consequence.

    The vulnerability is not listed in the KEV catalog of actively exploited vulnerabilities. The source names no other impacts.

    Update BP Profile Search to 6.0.

    Affected
    BP Profile Search
    Fixed in
    6.0
    CVSS
    8.1
    source Wordfence
    Login required
    no
    Likely to be exploited
    0.85 %
    percentile 57.9
    Type
    CWE-98
    Actively exploited
    not on the KEV list
    Published
    2026-10-13

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  4. This week Wordfence

    JTL-Connector for WooCommerce

    CVE-2026-87855

    Affects you if you use JTL-Connector for WooCommerce in version 2.4.3 or earlier.

    I rate this as critical. The source describes arbitrary file upload without authentication. Uploaded files may be executable, which makes remote code execution possible.

    The source attributes the issue to insufficient file type validation and an empty credential being accepted as valid. It is not listed in CISA's KEV catalog of actively exploited vulnerabilities.

    The source does not name a fixed version or a workaround.

    Affected
    JTL-Connector for WooCommerce
    CVSS
    9.8
    source Wordfence
    Login required
    no
    Likely to be exploited
    0.79 %
    percentile 55.8
    Type
    CWE-434
    Actively exploited
    not on the KEV list
    Published
    2026-10-13

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  5. This week Wordfence

    LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes

    CVE-2026-110284

    Affects you if you run LifterLMS through 10.3.1 and an attacker has an authenticated account with Instructor-level access or higher.

    LifterLMS handles attacker-controlled attributes of the checkout shortcode unsafely. Authenticated attackers with Instructor-level access or higher can therefore include and execute arbitrary files on the server.

    The source says this can bypass access controls and expose sensitive data. Code execution is possible when files with safe extensions are uploaded and then included. I consider this report relevant. It is not listed in CISA's KEV catalog.

    Update LifterLMS to 10.3.2.

    Affected
    LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
    Fixed in
    10.3.2
    CVSS
    7.5
    source Wordfence
    Login required
    yes, user account
    Likely to be exploited
    0.69 %
    percentile 52.3
    Type
    CWE-98
    Actively exploited
    not on the KEV list
    Published
    2026-10-13

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  6. This week Wordfence

    SimpleForm

    CVE-2026-104748

    Affects you if you run SimpleForm in any version up to and including 3.10.0, where the source describes privilege escalation without login.

    I rate this as critical. The source says unauthenticated attackers can create a new WordPress account with administrator privileges.

    SimpleForm is a WordPress plugin. The vulnerability is not listed in CISA's KEV catalog as actively exploited.

    Update SimpleForm to 3.10.1.

    Affected
    SimpleForm
    Fixed in
    3.10.1
    CVSS
    9.8
    source Wordfence
    Login required
    no
    Likely to be exploited
    0.65 %
    percentile 50.4
    Type
    CWE-269
    Actively exploited
    not on the KEV list
    Published
    2026-10-13

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  7. This week Wordfence

    Post Export Import with Media

    CVE-2026-104764

    Affects you if you use the WordPress plugin Post Export Import with Media in a version up to and including 1.17.1.

    The plugin processes untrusted input and can create a PHP object from it. This requires authentication with administrator-level access or higher.

    No known POP chain is present in the vulnerable software. The source therefore names no impact unless another plugin or theme provides such a chain. If one is present, the vulnerability may allow arbitrary file deletion, retrieval of sensitive data, or code execution, depending on the chain. It is not listed in the KEV catalog of actively exploited vulnerabilities.

    Update to 1.17.2.

    Affected
    Post Export Import with Media
    Fixed in
    1.17.2
    CVSS
    7.2
    source Wordfence
    Login required
    yes, administrator
    Likely to be exploited
    0.64 %
    percentile 50.3
    Type
    CWE-502
    Actively exploited
    not on the KEV list
    Published
    2026-10-13

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  8. This week Wordfence

    Bit integrations

    CVE-2026-104749

    Affects you if you run Bit integrations through 2.10.6, map a form field to user_pass, and an administrator re-executes the related failure log entry.

    I rate this as privilege escalation with possible administrator account takeover. The source says an unauthenticated attacker can overwrite the administrator password and fully take over the account.

    For exploitation, the source names a form field mapped to the user_pass parameter of the WordPress user update action, followed by an administrator re-executing the failure log entry created by the anonymous submission. It is not listed in CISA's KEV catalog.

    Update Bit integrations to 2.10.7.

    Affected
    Bit integrations
    Fixed in
    2.10.7
    CVSS
    7.5
    source Wordfence
    Login required
    no
    Likely to be exploited
    0.54 %
    percentile 44.7
    Type
    CWE-269
    Actively exploited
    not on the KEV list
    Published
    2026-10-13

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  9. This week Wordfence

    Directorist

    CVE-2026-17092

    Affects you if you use Directorist through 8.10.2.1 and have logged-in users with Subscriber-level access or higher on the site.

    The plugin does not properly verify whether a logged-in user is authorized to perform an action. I classify this as an authorization bypass.

    Authenticated attackers with Subscriber-level access or higher can delete arbitrary business directory listings, including other users' listings and posts with published, draft, or private status.

    Update Directorist to 8.10.3.

    Affected
    Directorist
    Fixed in
    8.10.3
    CVSS
    8.1
    source Wordfence
    Login required
    yes, user account
    Likely to be exploited
    0.54 %
    percentile 44.6
    Type
    CWE-862
    Actively exploited
    not on the KEV list
    Published
    2026-10-13

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

  10. This week Wordfence

    Gmedia Photo Gallery

    CVE-2026-96661

    Affects you if you run Gmedia Photo Gallery through 1.25.1. The SQL injection requires no WordPress account or session of any kind.

    A time-based SQL injection caused by insufficient escaping and insufficient preparation of an existing SQL query. Attackers can append additional SQL queries to existing queries and use them to extract sensitive information from the database, according to the source.

    The unauthenticated mobile app endpoint dispatches the library action without validating the Mobile App feature flag, a nonce, or WordPress authentication. The source does not name a fixed version. The vulnerability is not listed in CISA's KEV catalog.

    The source does not name a fixed version or a workaround.

    Affected
    Gmedia Photo Gallery
    CVSS
    7.5
    source Wordfence
    Login required
    no
    Likely to be exploited
    0.45 %
    percentile 38.4
    Type
    CWE-89
    Actively exploited
    not on the KEV list
    Published
    2026-10-13

    Sources: NVD · EPSS · Wordfence
    Includes data from the CVE Program, © MITRE Corporation.

-12 checked and dismissed, with reasons
  • 113 advisoriesSteht nicht auf der Beobachtungsliste dieses Lagebilds. Entweder gehört das Produkt nicht zu den Bausteinen eines Webservers mit WordPress, oder es ist eine Bibliothek, deren Korrektur mit den regelmäßigen Updates der Distribution ohnehin eingespielt wird, ohne eigenen Handgriff. Meldungen, die mehr verlangen als das, stehen oben als eigener Eintrag.
  • 23 advisoriesDie Paketmeldung einer anderen Distribution, etwa Red Hat oder FreeBSD. Jede Distribution veröffentlicht dieselbe Lücke für ihre eigenen Pakete als eigene Meldung. Für Server mit Debian oder Ubuntu zählt die Meldung der eigenen Distribution, und die erscheint hier als eigener Vorgang, sobald sie ein beobachtetes Produkt trifft.
  • 18 advisoriesGrafische Linux-Software für den Arbeitsplatz, etwa Bildbearbeitung, Medienbibliotheken oder der Druckdienst. Ein Webserver läuft ohne grafische Oberfläche, diese Pakete sind dort im Regelfall gar nicht installiert. Auf einem Linux-Arbeitsplatzrechner gilt dasselbe wie bei Browsern: aktuell halten, aber die Quelle dafür ist ein anderes Lagebild.
  • 17 advisoriesEine Programmiersprache samt Laufzeit, etwa Go oder Erlang. Eine Lücke dort erreicht einen Server nur über ein Programm, das in dieser Sprache geschrieben und dort installiert ist. WordPress und die übliche Serversoftware sind in PHP und C geschrieben, und was die Distribution selbst in Go ausliefert, meldet sie über ihre eigenen Sicherheitshinweise.
  • 15 advisoriesSoftware für Arbeitsplatzrechner und Telefone, Browser eingeschlossen. Sie gefährdet den Rechner, an dem Sie sitzen, nicht den Server, auf dem Ihre Seite läuft. Aktuell halten sollten Sie sie trotzdem, denn ein übernommener Arbeitsplatz gibt Angreifern oft die gespeicherten Zugänge zum Server preis. In dieses Serverlagebild gehört sie nicht.
  • 8 advisoriesEine eigenständige Serveranwendung wie Keycloak, Zabbix oder Snipe-IT. So etwas installiert niemand aus Versehen: wer sie betreibt, hat sich für sie entschieden und kennt ihren Update-Weg. Auf einem Webserver mit WordPress ist sie nicht enthalten, und ihre Lücken erreichen eine WordPress-Seite nicht.
  • 7 advisoriesVirtualisierung und Container-Orchestrierung. Bei einem gemieteten Server ist das die Schicht darunter, und die betreibt der Anbieter: als Mieter können Sie dort weder etwas prüfen noch etwas einspielen. Wer eigene Virtualisierungs-Wirte betreibt, weiß das und braucht dafür eine eigene Beobachtung.
  • 6 advisoriesNetzwerk- und Sicherheitsgeräte wie Firewalls und VPN-Zugänge. Sie stehen vor einem Firmennetz, nicht auf einem gemieteten Server, dort gehört diese Ebene dem Hoster. Wer ein solches Gerät im Büro stehen hat, sollte dessen Updates ernst nehmen, denn genau diese Geräteklasse wird derzeit besonders häufig aktiv angegriffen. Das ist aber ein anderes Lagebild.
  • CVE-2022-31628PHP, lokale Denial-of-Service-Schwachstelle beim Entpacken speziell präparierter Phar-Daten; sie erfordert bereits lokalen Zugriff auf den Prozess.
  • debian:DSA-6583-1Quellenlage zu duenn fuer einen eigenen Eintrag. Die Meldung besteht aus einem Satz, alles Weitere waere geraten.